From 32ecbb8b6ad23e25d5567621d645f7481346868c Mon Sep 17 00:00:00 2001 From: Maschell Date: Mon, 14 Dec 2020 20:48:49 +0100 Subject: [PATCH] payload.elf port, not working with mii maker payload.elf loader --- Makefile | 2 +- data/launch_image.tga | Bin 903212 -> 0 bytes ios_fs/Makefile | 5 +- src/dynamic_libs/os_functions.c | 6 +- src/dynamic_libs/os_functions.h | 1 + src/dynamic_libs/proc_ui_functions.c | 54 ++++++ src/dynamic_libs/proc_ui_functions.h | 66 ++++++++ src/dynamic_libs/socket_functions.h | 2 + src/entry.c | 146 ++++++++++++++-- src/ios_exploit.c | 3 - src/kernel_asm.S | 239 +++++++++++++++++++++++++++ src/link.ld | 35 ++-- src/main.c | 78 +++++---- src/utils/logger.c | 89 +++++----- src/utils/logger.h | 41 ++++- 15 files changed, 634 insertions(+), 133 deletions(-) delete mode 100644 data/launch_image.tga create mode 100644 src/dynamic_libs/proc_ui_functions.c create mode 100644 src/dynamic_libs/proc_ui_functions.h create mode 100644 src/kernel_asm.S diff --git a/Makefile b/Makefile index 709aaeb..85c5379 100644 --- a/Makefile +++ b/Makefile @@ -28,7 +28,7 @@ export OBJCOPY := $(PREFIX)objcopy # SOURCES is a list of directories containing source code # INCLUDES is a list of directories containing extra header files #--------------------------------------------------------------------------------- -TARGET := nanddumper +TARGET := payload BUILD := build BUILD_DBG := $(TARGET)_dbg SOURCES := src \ diff --git a/data/launch_image.tga b/data/launch_image.tga deleted file mode 100644 index 4679174e5c7c3f59bed9cb05db23f397476a75e8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 903212 zcmeI5KT{h^+ozv**C&M9$nqC}Y@xR5R2?ZGAOK2Ft!&Wls$MBjpi?C%6zGu^s7eah z(B2T7!52835S&@bo8l0h!3oZWI5ghK-upMrcqH*pgAqv6*O@xjXw);)eRa?LxV!J} z`yc=KPyY!2```ch|NYy4`M0wzHV8lf0uX?JZv?(?bvqx}AOHafKmY=s5kUV?e+WPT z0ub<#0Q%=+ty5+QKmY;|K>uh15P$##AmAeb^v}myr_2z500ba_{?P^?009UvKKb;=9@2tWV==pStW0uX=z1bifb{`pwzloy#M+5P$##&_CJ$1Rwwb2>3_<{qwQbDKi8h009V~ zf3yJzKmY;|@R0!e=VPr?W(Yt40uVs|Xaf*{00bc5BLVc!$6BY%5P$##Ab|eS1|R?d z2tdF`0_dNQwN9BK009U<0R5v4KmY;|fPjw#&_5q*oialJ0uX=z`bQgp00bZa0UrsV ze?HbaWrhF*AOHdMk2U}S2tWV=J`zCxe5`fK3;_s000QVAZ2$rgfB*!1B!K?;SnHG- z0uX=z1kgX)00bZa0SNd=0R8i^)+sXtAOHafpntRh2tWV=5b%)z`sZV1kgVpYn?Jf00Izz0QyH8fB*y_00AEfpnpErI%S3c1Rwwb^p7?G0SG_<0zMKz z|9q@<$_xPrKmY>hA8h~v5P$##d?bMW`B>|e83GW100huK+5iL~009X2NC5rwvDPUw z1Rwwb2%vwo0SG_<0ub<#0Q%=+ty5+QKmY;|K>uh15P$##AmAeb^v}myr_2z500ba_ z{?P^?009UvKKb;=9@2tWV==pStW0uX=z1bifb z{`pwzloy#M+5P$##&_CJ$1Rwwb2>3_< z{qwQbDKi8h009V~f3yJzKmY;|@R0!e=VPr?W(Yt40uVs|Xaf*{00bc5BLVc!$6BY% z5P$##Ab|eS1|R?d2tdF`0_dNQwN9BK009U<0R5v4KmY;|fPjw#&_5q*oialJ0uX=z z`bQgp00bZa0UrsVe?HbaWrhF*AOHdMk2U}S2tWV=J`zCxe5`fK3;_s000QVAZ2$rg zfB*!1B!K?;SnHG-0uX=z1kgX)00bZa0SNd=0R8i^)+sXtAOHafpntRh2tWV=5b%)z z`sZV1kgVpYn?Jf00Izz0QyH8fB*y_00AEfpnpErI%S3c1Rwwb z^p7?G0SG_<0zMKz|9q@<$_xPrKmY>hA8h~v5P$##d?bMW`B>|e83GW100huK+5iL~ z009X2NC5rwvDPUw1Rwwb2%vwo0SG_<0ub<#0Q%=+ty5+QKmY;|K>uh15P$##AmAeb z^v}myr_2z500ba_{?P^?009UvKKb;=9@2tWV= z=pStW0uX=z1bifb{`pwzloy#M+5P$## z&_CJ$1Rwwb2>3_<{qwQbDKi8h009V~f3yJzKmY;|@R0!e=VPr?W(Yt40uVs|Xaf*{ z00bc5BLVc!$6BY%5P$##Ab|eS1|R?d2tdF`0_dNQweCZiyB)XrP}b3v5sIT@%axy= z0Q&dzbwCatjzG6_+Bw_Oc53?faM$(uO42}>`rHDNTXys>xpnJT$=o}-+i5q`^;GRk z^{{eKX_QW?AJD;j{~d6;m9B4>x66l>lWMA#u9up7Eh!;?S@`vACAYNbUvlf#pOVSu z`_L)YFE+Q!bA_Yq#?tcQ^1{mEv&>W;{kwlV_`Y>qU0H01z zc<;X{?q3_6`S1kLzlUea6(5s;?2%6Ed96`C%B=*dx3cIqy}9QK>b-l+{3PjK-?mPw zZ|W<$vr#(FZ7hlV%HmZ1c?~Nt8Bdjer9l7utMkb(@u{iX#pY2? zUK#7=m$6z()!ZBU%UOzd{h#v%wx1*Ls<2vWln*Kw=JyiW)$QhX*=gX) z;>OZ;SspQ1fs_Aa`Bnn-&$k+%{PJqVX}kQ^EWeG#H%oH`r+sHzd+MR9yeb^!G#aQe zDrXzYPGP$*0mo51_p{Ua?ecT$T|N!0!FH=r-p_7WEvzg~=Zj4gaPprm-%5b~`BvkT zUS8?kYH7t3O&<9Nl@B)3r(>yFqqLvZds?damhHg_sK-+l_f-D4Qf!_Y_itOj)u;1P zz~zOHxpW-`ob;#5xBR1jzSa0-mskCp^95<##^UF-bY1V@ZYNb+wUI!3H$V70e^?z= ze&TN$Ka*V+|IDY0sqXVYU-Ju>=s7ueIkJV`BdAJURJa7 zIDc3umREk2_k_0O}ZxdlmAm2_iI?sr&&u&tED|tziua8pUSIGZdg0*;nS%X z_I25OLt62+VzV9iRcdB|?c29FTd{dkoyu=4J)OmCe{&f1gUX)yhJM?+*wjei%HmP3 zXbR|0o1~vq0WHRAX1nl}6u<$ap6Uf8GDx}ABO z_dk4IA3miN?^Qv*pWjUZ-sGW_I%3w*;cBiKEI8{d3)ok z-5yrt1N!i9^*C4DSUj$(2k?1K>qHN`HOyZ8W}30vy4XzDr0;&I@#i&Z@kw>X)*5v)1@8WL*7|ExweL1^dA{~bX5~^r=L^ql zf4FUVVJ7o=ZO?4rgUVC?1)#Clsk~N!IosMUJ5QeDDxRR@`5cj}egf!UKM%f*BLS`4 zwO!UYpY=AHa-3Svr_|@^>>hXL6|+SxH(MHm96m4W<~btOJgCfMWWk>2WXl~^W@B7K z>)xE0<$1BWvGjCaFkzXOFKzMb7!}>s(2{E2e6S;~Apnnky_QsQdR`OgeD87TU zn|53A?5*f6{m^?GX6clyH#Sv2$_{^R`D|Wn+UQ+NGxk5`xGc((NzS>nR<76ZA`KRi5!|Pvi;$Ap!I+B*Evn5|DR^d#8S}9=~p9ry|e$@z`Yd z$oI3;I<6j9PlntMDw?@3OSah5D4sl7zQj2HxcWR;@6@a<^SK-s5;ph2{ucPqnX`x- z%M1U)0>lSs>F_}%injEa^B{`N z&uhcmjH6e{<%R8_57haAzFoosY_9Rz)ZeE(KHfHK_ZvSB=J!&TFOOzsYNiTapgh0hO#uBH@A~mQcc-0p zb2_gz&*b^(WqqI{wur_hoRlo6S30 zJYV}#?e)M+*XIkGA^!L(k<>ei@>Kp})5U#vGdEH-TYdY=3UulLl@Cn1uGQ-B0p%$k zZvyDwc-N2LxjWq|HK%O!Z$B&F&!X-3tD0s7&KDF3Ni*=$^>n>t>u%}Wfq7ui5Be~A zEXu1T_ZLPxpezedvlq9^`mO&iZe2F{fUcNV&$%!*{b@C9Y29vTDzB9^tvAlB5zP+Nieg%oQ$29QY}SXG+b-|Kh(9!Jq@(dncVMHW z!*EfWb@M&aYTfPD$6Q2tX2G%lVC?%TubV}#^}H1eVrB7P7N-~w7@wcv@h&_1H{SK* zckaFg9xw8#(5$j!n+MqY)^=-;o!ROz{WId#U#j(`Q}tojhF)H5lw>pdv)KybS9&gc z*+%=z3yN^q?Mx5ExL95|&+V#K23FwKDy{mf#CgEX7uv1UvHk1c@288>>#f3HXS9QH zC7_t9v%$(|XBK5>r*Exi^@M5_X{lU)uV@gB!1PRZVZX%~z192o!X7@wa`0gbqO}jT zj)2H!0yVozd3NE@l(F49@0*jdaoJn_r7AyM#m2=0bX=b=@`e7<2F90w)_(cF>1UZa zi?XM=@4Y>3de4^Z&3sVlxBjGT^1MGaC2QCiRKL<){|)`So{M@vU4&n)z&e;_W$~4b z3!ZJs(FOO^MLqF40)7OnwPY;M~qw9yD@Ba*AE?#f{SwxPl zzpm9k)z~*1Pjxjn?yZdc`APu&^R?zDtK707`t?tCM#>_fUu^dFzB%hO%kSKxe}32hq?G=8{rebr;1`?wS&Ig=_{QGWn#aDeD35*X{p|A>z4;9n|%M$&YlxK>3GXH@#Fc}1{(?3~&PPdB9 zIa~F5!y-VuUHWXRflB=@Hf?P#dsh#$p?|kgS_$lI+0)bci1Ksmdsd{sLCWagWIR#i zQUtL7Xa|!(;ClVjiZ9z`x8i52erS;iE;iMsWv#@Cj*kA_rhl@m4{fAR-Ylt_qujM` zffbqU9sAQ&(7#D|p2(vkfd0`ECV{~9`e$!j>+M{J?lgCTDDQ*kqJNX{JdsC70R5vSOag(M^zZGGBGc_>Uzaa7Qx^XrRkM|_ z*E9w=_+Gy4JNDmgbo85z_$?k~w~g{|_223jn>&?{wl4W~l+nLQc%I0kBY^(V5+;Gb z&H5L-oh{OUJThd-E!#@icfHLAe;hA5jQ zsJ}QuPnhV}a1Z^Pgy)GoIs)h)EnyM}+^&D_-8<-s5x$Y{{v3t=N!?1#lv$+O(seg3 zsree2db*kUv8C&~EyX!h^g_j1uqVP(Z9QO?xqwEuYc0H?ebAhap)~Fll9O}=QStMJacOM+1_nq@v!otqj*Fc zi#vgriN!q3DyP$Vt>LEMOxZ7eFdstwq^cL2>eIZ5M|9jgj4bz>Su*T~{!PO3L>?Uh z^pBP>2?Qof|75kjF3%_?p~b*kkpeEwEF1+_eZA7UF$|J2X!5y8RRV zn}p|yJURmCA1z@L2*lGr_3TYs?16*Ij?D?&E`Pk#qMP2_cj@1Co+>vT3-v|%q3iCp z&N}LCTwZvVS+iA1Q_?@vk}p-aM&@2ebLkE&wr?2GLh%&dnEtu-HI;td`cGZ&=}mXN z?)c4WIgI|TTi&I(sd~}+ZQDQe{3eFsarAEzo+t9?2%vwogh?O}Q~wq%GC?p8-sytb zP`BDIx9gu&pxCte6@e$q&Hp~HrRsZjSJ_uzsw>v#>8v&#IjBtKKd)(BHm7HAmlPvC z+P(z6qDQ%QYpWt9a{5isz(=_T5gpZg&}Kb2+(Q1Mk+qjm4u}x3g!fek%U3 z)>*ZFThruF>PfK4%O!oeUQMZ4 z3RW{!)Wg|@>HL|kFeU|>52EmCrPG<9SNFDjxRJ%%`b+QDzvV#lR!cM16RUX->E?${ zf1LN5Xrh0U@H~-6M*#h!B}@W=c>3oe!yg7QdyaC_!jtOkl_Yu(xoAgh1)XJhfUS<|%G8+FYHP3_jVox?T)yO{agFDemmQUJY{gpVL3-niNp_ zr&xuu+b%Xws%CR#i_PHEMhPvxy(y(4?b)*$%nZE#?!8AfUr_T6d+*%4f4BX&viPdt ztXSo7Kilod_Ed@P+R(pAc%I0kBY^(V5+;E_9Q|9ju`B7Hd`i?8D*ZeD3Hz_#ev2%* z>-VHHVgIL#5hNWtsjik*ONvYp`oGMZf6jKWDT?0N)@n(1U!&Y8&6?fUHJ=%c`!&k$ z_?N)@^ZGm9bhKCT`uFeFKPj}co2T>hg|_8zwKUuu2=s3fo+t9?2%vwogh?PUjQ(k^ z!@6mR?3F?NJFGnWF@AT|lmGVq&wlL~=3C$`Vm_QJi_UIqxBj$oyJwksv#AtEPfC(8 zP3he<>tVxY+bPcMT;Z?F5kY+qy+4P!^Kfad*S~e+CmYo1+=~4bAqAA0pV?e~H)}&> z(#HB{lkn7#$GZrie|Hh$_i-R_m;R||Zmw`x(RNTdsmlAY*ZwOux6AHVt=v3l$vnLN z$)81QryS*!8?E5-*5)(Fk219XQWifiQY$y>-SsWnXrHBPoA0H|r@TL%jToi>xxK6U zr@Ve%JE(lA+WO(fgYO2U%9fmD!;GQ?_95mTua7bbFge+r#T$w=-7=d?#(*pZqtaCL4iw zXz2ersDDwsUgvxA!LFe5bmm;)w%H8vweTAKv)O*~la;l%*P1IhKAOR(QA(%7I;I&M zE>*_nl(^#&NA011Py3{B_c#R5zc{o=`&0yO*FRZ*8s*zW3|Xnm7aNKEB_mIle)}(N{h~T<9-#{w zC;Yzks_^%(!3t@=zA6O0kUjQde9h}UV^IHA7B$miuQgxzn3E26ZLY&rZF9Z3>H3td zS)+bkq$zo|b`<8GQ$*Za#u z>z~x>`&OrQP?7)2YN=7$E=!-awXG+1yS!7;eD+9_=1cuYU1Di9ab;sNmzM0?rI1+l29FExjlPWp2>;Jd^c)xbtmhvIB z&*h;v{)70~y!)1oSelvzI@d|nbu=WX&-KMAvk?!1Ih9(?P4go(H={R=_R+t`d@i`x z&k;cXevTh!KMsN6^lzu)dJNTT7M*0=b0`uDUtchlVm_0O#@^P>J|_RW%;J9%Bt zrd!Q)ry|9h&UZVV)^)3@V*fpK+vj?tBY^&mjxASyI0CoppL*>yx1fL1oOku+4f=oX zb*A$D*3H9@|J|fK<8gdY{}gRPo}Jy!i%b6?9SM3fgV}zrCsgYSXdXt}qSGtwbfKT3 zvjow@OGzl;X`7<}5b7Q#zXypFOU&o1Ipw7FyR4MfC3> zS~}NwOakcNW76hc_a$(b{>cJdS^Ph?LiK+3?b7Ep*(tsH_oXUJaNmB{3MPZ^Z1hil zD>hl#vyRG z{^{+zVQ+1{zpt);c3hpw=r`Mfe!c#8_g(rI^{Zaje|gid(Q&tT-MMF5e+~57I$zJ| z+}^XUKicbS+MD|3{lWgvkcRlVeoyJ2=J;t2$4T{@^>#+lACxLQIaT{$Q4`Yj7Z!t1 zc9gd8_wdslD_JVd*)Lj@y)fOL`Img?^v-+N*&poaUf)rdVz0A%<#>3HtDiUNU!-Pk zwnMS`);v9DY&}x9Zs~P@J4EMP(hq!*Tx|Q{>XuXxcq#(u-&2w2zHtb|)4z{_{%x24 z{#Ek*+3Eat zSu@^y6;R*0cJ^xNJf~jUKe9);sr+-xt$a*g*|`V7iZS8c^sH`|k8Fh&&5sX{O8-*z z&ufY=uetrv@tgPV*1zQ-;*w(UD*rPJsk*HRvv!@o3;GwQ9g}vv2%vxCRUhQ$dIItE z?W)!l=C?HXWonExgmWCw-24^ff*0| zR?F?PVKjhtBXuI{%A~tB9?9Xfc zmSLD?@bhl{TVI?mCey3Z_V<(KPM`|RhaZ;b!>^juDQS<$~quR%ZZA4mV>yP??- zX*Nd=L<8YG@-&ssgA3^SXB3&%KoMOr}4n4 zyhaLTiA75Em+f0msm-yQ$}5&%$D-S+Kh$}<4C>VI_Mb~RlaZ&4<<3;PKd!{!mEHGY z^iO|7C?;;h;#Vlv?cEd|U-U1zPhs*(hW;h5PLo)o`{>`zdN=sXF#2Z^25aUAV||_J zOD{`3J9C9+nL~>&_~tUYyPGGlY<-`D5o@J+*5heCvl;``sNu3=_V#FGq*a%yX5)X( z8VvuH#`TW>>A0KaAq`IB{P-ZHJdVB-_OpNW`_1@ zq^E;>!|UImy50R9{Y%!9m+aD@f61=jq?B$P^iMX{yxDux`EZu{cKMn0eg-=D!~Roj z-Ov}bS9hdzuge-4)CgjuEdS8nvBdtg(mz>UTC=TplSS66f2sN(rg`DK2U&;xvm<)1 z8tvbtfAV@6wx9DRB}D&{^33^A4)o85TAutej)VTmZab+iFTA-N+jH|54$X$s$X;mw zIm^y@xkQR1o9z46cBFqlEWzG1;lAttw9(7Uxq)tmp#IgET&REUinErV-!A=36}5eN zL6ID;vns=@D=)qAZ$l+hTtBz|XL#g3pXlG@KW+Y$0R8i)t|z&q$d8=lVajcbEMqAJQG0J$P`r9agq&9-(|jwYs-dOujZV)=R3fMr}p2 z8fO-4RMEaiYIk+-s{YCHn=hm-{zJMxeHl0LKI$j0BaLvf{@ElyZT{pP{qv`;C%L5K zqJK8uul!5qJebAz%KAcAOWy)(Dzg7HSAO}LQ8;_jtoKwtpXx{5vHs6!BymuoZt{Oo z|7+y`A{BdM{h{YJ%U;`dd9`$8o|mv`BTFb*35gnxXKeD$mO4 z8!R=af48syB709(GSQHLn3 zmPOl6S)*Em@9OY-9R2&gb!h9m$R{)O^6a<&}X4wT^RO$>ZtRDu~e77 zD`840)NuNDVljPZ7aFEqXV$l>?QCnWHEpx+-voWE{hHVNZBYN#7j32OPNO_yy8TP$ zxT50_fj;$#LFe5{RpRbA{t-=r`g%)3%c3OeR#k{?Fm{Puis3!S%)U z%bDyt64`%$**95I@^0DB9#`AV51qYEsd;EC#OT=e<@#i{N~o<`?NS|7iuFB))kc zW=m_JsTcHPZoV*Wk^I#2>3SJmZ>RK1-kMTCDdlv2t}vZH%4&9@u6TFow+b%20>`66UpS2OLtJ_`rcUbxR*V%<|wz{c@t@^2c!cfb!F4}+m+6Y!F zI}2h!?6n$YtqD4lvCaNnw&;HcmD8Si2~xmzbG4*MNx}R+yQ1dzX+ELWa@kn=k6)+r zz3ZcCzQcL$KYo2{wwmVBKg<06>)>iHdY-59fB*U{$eqhyq>kaP;hY?LoHWqn2dFPf*II7rWH8iBjI-KBqR z>z6#Ngeyx+hmNbq6~%Xuq9~HzfsHnXvHjdJY1l!fVV)_gB}D<0KWM)mx$mjkPR0CJ zY?bMTMe9|ZbsgX9oK&~VDVs+Zo%4O`)OsejO{28_OscNYO(|ihYSDf5i(5q6qrD_HN*a6h_MxOej}QHtxz`C@aQ4HA>7g4B zj5M!z5B-z>i$(aYTx@Qe-wysSNqvqeS3d#tub&6s#*;uC{geH2p8MFdo#+0{_KpYk zYM=JeKb!xs)^45#^B;=!qul)!kp9o{e1gc;bp+7A>!@&S+z7pC$*q5OSYiFM@oD+wWRwKZzfscV+7Cql{d-7XnnC{;>3_KX^)JEt*VC+j zo%prC9_rbgcDkMWTYtoVpPXlkoN653xa8lY8`Sh6p_MgwSKS^c(W>IGEKP!9iP2c}rHcJ#M zKKXkGmH9$HfrtCHVsj~WTc?bvKwtt0pnsF30Y2yTZ0k3R?0VH^d6+l%#*!i?`LZc) z{KIg&dX?pc?XrAmd~U0heNqUZf0I&EzUT9FtJIvjA%6SSw=hSZionX^NfqxG-=Ee= zDL?u*DK+JLK4nofM&<$YRBDm5`?C6(@6YLEl^^|^torgfw`W^lsz2wOI9_VAu_Rwh zd0mcIzJ4Y*8vW}q`bY2Ygb+agd{&gnD*M@1v3Z_LidwAL9J{IftHONYD4QG&TwXY= z(EB-A&y~-)MgM%R{mCl3yehVzv`?> z<}kP|I_CC%c4oui^{#%`{6XgaP1aN8cW%)?zw3XpN`JPMuJ7MFGSAibb?=c4ivp;a zKW_f_8~fCr#ZWTOP@5NLvC;Lbeh>G0&yKghZu1Slnett19#jsiyRGjk*H1;A4ezh~ zzPa3bS8)mQAN00{DM#^%@8@JaPvjQ;qYX?B0a<{f@qyV``j}Hs>qiYT%G;4zBp}u8x31wG+p0qy7e+V`#b!tA9*DJ!$sJlmSi$L|AGnL<62Cb!M^JR(QaLA9%c1ROy?V=z0P!gwKSbSx0PYunEst^om9K_ z|7%l1S#EdhL6l;?F!y7jf+?99Tr#>4Ku$W}4yA@ZRooW9iTALFIYvV)J=zyL=z}c4hHA*ESWO ztoB51{U(6@=Xd>2Ug^)wUu3!ve8zG`la*JFSm-W_Dz+09W(PghZCRRVd-&Mu_u>H4~j49+a9mfAtT>)@4K4ji4+t6@;%S!pYJVT^2*=soNXz7&s7Zz_2lNy{p@}=^a|-ur8ThSiD_Oix$j$NW&d4hz+3=j3KXq=X zqfY;%;D?oiO1EeH?LY_49rt3Q=S`7So~{y(f7n>Xfu_Si-W<^Oq}lg@2YUxic9`1bXzU|IOJ^ zQUD#-ztY0+-~O~e^UZX|dJDgAsRXafHsWZupL!*KR#%?>|K4-uH9BWK#Hin-K1qJ(8~yXU{wKHer$I01Q8waNm^aQv1TsHGRsg1eV~9`Izo!4=W!S_nVNlo+tN7 zA6?GTztOSf%A+PA1>9}PU(wbiyVk4Ye(Ll%XNB|e*MH1lf1LY1#9j0^$6P^ceV*d= zg8oe`0rYRw?`W<+S^{V0tC_a7z9v%xA3}>B_Zqeys%hU;{Z2uq z{*9I|S06nAS%KY7s%A6cax1nvwT((W@Hp4wD$ID^P2-26`*vx*aBORdV)>1}Wpjs7 z6F~n)O_=LH27zwpn`vOWeq3$Xc-kK}x;DEI&R5{`X9+CZJPpl|pD*l`pV#E?g1_fu zv}*1#Y69rrs0nlZ$08s*@SBZB6`QHrN%f%ey4xbMy00Izz zz-S1df1}~bRUrTY2tZ)G37~)DT|eXw0uX=z1V%#u{TmHet_lGNKmY>cO#uBH@A@Hk z5P$##ATSyN=-+6#a@Fx5pw+(~GAFlR@9MApNBX}#RKA9}>M&^@DnDEY0+T`j{hO4U z@;#q=gNK_~M7rkodVh1Qx)z&!ujNweS9jLc&)(nMet50$7k9nWYp$oOhgVc2^u3l+ zUEbf;jna{Kxg?zvx-HaenXVV=UPMptub-M?YZx}vGNOXU9?eKf=x85_^hrsv}K>x20KP-GIUz9(U zK9$<_PBZoUZlElsdg^znT)OtD^uBabD%PC-bUU5qMft>zWomn^)bFLbj%R90eY({S z&Q}VZ^|kWhN9q^r?dI3Y`;z@qeqVU89_m21({9?4()&W%?vSaySavon3PGw^)V2d9H+AQ^^mGh+Zsl40NJx}Z! zx|{B&9J{<7+Og9u_ua0#E}eC0+V!uMw&kJQd13eXkq^t+t{si?{=t6FSXtV2Q8+2R z=()yjKrAY|?vtr?txP}Il+t$gCp%N54hyCFuKi|tHJZE4@XV+N*@M9N5kUXOuTIF( zRRVhRzgWL0zsp~g)23%qiH^NxPq)(R?+SaZy_VEUs-&Y*ioKSULPzvwJ~S2jwzb=O zUwW7CG{0@VSU)USq`>;S{MU+9plizL_KWr1X3!p5|!s^;i z|4aeO(z~w}DN?2;jgtZ@M>-;%Q~sn3%8hbjXKv}dP$i^6?+QElQvJ+y{>A#I(mP9) zsY#*U+dc+HHNayq}bu zT1uP01q4&;FRa9&+KcvKp!2TuXT~f4@>5xVXXtLm#?qGR?Ruv6HK>yp>$@%eg>q3A zgHVgF)+0wCFir%}zj3M!@^Ui)MR;%5PfS}B-%mQDION~9inizU@5TCe``&eZd}iV4 zef~Y@)sqH%DxKN+rWdA?XIo!QeZJXMqy&l;D68m`DVj?!J^N&D^6=@9n#w|Q{f+AJ zv+J4a={)V7ZJCk=*Olr>Riqg23T@Lf*UZh2%lW%P(Qu+gM_TFPIjXX%1MSs6cekJ{rXS9xmCkEV_M&Xa_KzM#rB+|%nOT^+ zQgl`Ihr0Ypt)*9)nyH;}`4BLX)hb1lF81l4{S{EM9_6UFw_pFn{gd_TUKl%-{WQ=& zS5ww2Y=2WYT`bz3tk%$GzO63#4Fcmp0R0<>S|AU@5a`oCv$r%FX#J1{r+*jL+xXSq z(60Z}DUEC}XEBycIg8e__+s6xlyb@5=jv;e)#h}<_RUUm``788tV}n8sGMqKO+B&N z)N3kBEVP{heKGYi+sZV`rB=V|3)4KEDeFyV=v;l1J{L`aI?dfnn@egP>R;OKqg+X0 z9HU78?5c%ya1XoA4=r?8Os_XzO6R3jvhH*zm&>dAr@mzC7q-6yTsr;RYyU~nFHASh zPP|lQ{S^`BCelCq8^LU3sjgF3mx6yGFunxPzwxaba@J3vSO3)isc}8$b>jLzzuJ3# z*G8zqP1aZ2bV%cD8V&qZPHD`_yj!#{FBo?fogMD$ihBRce(SgYY%I-sE%lo=d3x-& zw0$xiQ*Y;c8->&zyIZ=tEKF&JbVvWoOGMu^E@)b4s%6%cQcG9s>fDGbiVpOMIlpDe!{!- z>Yuxx)c$=iLaA$BuYa=6rF|mE27yT+fc{NFEs;kN7}P&`GrEyLr+<2vJH=7zJ<}$Q z56Y88Z+p`ivxt=PYo%#6o8IFZ|I_$cH{7=~oMQFspVLDdYqQ_oj0QLUr)$WLlh=wo zR+Jyvk!kC9e6hZh*9e*vPu`yI@*4G%^>tW~cc$sh5A9NKWwBl~KTMaOUj36@>2l>- zL8yPavaC?qv4P43{y<@xUDJJccjZjVC{h}uRL(RqsnJyTJsAHp&3bPZpi|jU|8!sX zm%$6`YqtJPE2ECwq<^vxd-LjY!@m$1R|4qYxYi8$8YG~8LiyS2&7Zb+xyHl-4G8={ zPt1CfAA-@yf_!M?f77+}pUTab z`c||t#CQ3&`J{f6he}@Kk{b21eq7V67wfNI%EwdJ2(?MxtQtX-652iNs`Bb7nh$Gl zZdGnaB5hZDALLB4D4b`iO7hOUHRWX^+f}+HH7y1{FDmU}LAif#il&iOX|VDo>StSa zHM4NFX=GF?syZ>{&mRU1qS4AQM|?tH90{O*<5(-?={f>k>)lkJr}_*#%~D-biGVXXSrUxaNjA7dP*ZjQNQDEGi`J9 zG(S-Ns-c%hsjfYx)XW9Vj&Qw*QYXz-a5<3b=$o6#pww-xI6k)5WT-d6fZbo@GSaZdt zQ`{!4NV?Zb*Ic{`iy~`LncBh1Zi-B=C_=1>){3z+qiZLhG9`q- zXb7Nxqv6U`{UD%N4f&VNm-&CbeyLTp6^~-=pNcr4wLF_IwKAqiC?doALi6QoOWAz6 zW2<~h5#N`ZFQt&5%69yvi~XP#KVRF*pju~4aUt?{hTXx=uqg3%&3Cp6cd4#xgxcx{ zX-Wx!hbMskJv>vc=nny>e~Kok)uXj)wN|HYT2zKiE&oqNWD4y+Mbvv|@r`6JHuG9> zT2X41vfH^RH}kf7x2;C~LHnk5+7A@dG}X?qV~S#=RjDo7tVJ-)zm$Ud!@80R0;URj%m^0qI}!<+~t$ z`n!BOh_uvJPp9>LUi`5BBK=deJ}Kdj*?p1zSu7&6_}&$Y7E3~V?=7a0>7Nueh^VJ4 zzH|C#XKIU-)fdu~69NxU0R4M-rd-h<0@6Q=&}VUBrC%S7WKaB{U zSTy$3?-s}1BIMqze>MVW+Dh-IKW&VXj*bBOH#)XlIr#)!|EHqSs^`+#Wr|bZwAit` zJ@Es>{?AVHyV-w=E!*4wX|ZrER=gtBD~h}#>0atzVD)`h|7S3^81#QyEL=-x_G8$$ zntaNX5CWqifc}k!D_8Y{z@`0XmfKhB!*ub}6%&0Y7@>k z>IZ={^LAOYxeqo+!R9r%{!g?2YWbIkrf`w|Y3{;dL8-L8Gi%Rg^R?dFkz%deIVt7; zshH}TN1;#ksLH=3nEw!*A^Xtj>Q3IgWXv<>znRxf=w0duYf1@$hbDmjJv33S=Mw?h zb(vbRuB}wpoIPpMZmU=;)is+T+`64To3&R|O8dWUzlBFMXTEK=-)<{NVZZEMp6ya( zYT9%)_ucKa?XL2mVS@k!?oR;yyFWY5gn-m8T>Z?gQ6?tQI%U0tqI6+O9dU~3KEv<& z46oC*6y2V5m%m&d>AgPt5P(2D0_a~nUZjQq1Rwx`WDr3Al2MP80s;_#00iO@K>yq2%vxQc##?c5P$##l0g9dOGZ6X3J5>| z0uYEt0R4-{i_{Q+00bbA3eG6+XA}F00IzzKs*BIUp!uK>w0akCXxe5P$##;t@dq;_)Ii1Rwwb2qc35`j?D)q!bW<00bZqj{y1?j~A&S z009Ue zJOb!nJYJ-R00bZafn*Rs|B_LUlmY?}fB*#I5kUXq@gg+@AOHafB!d9@myCL(6cB&_ z1RxNP0Qwh?7pWlt0SG`K83fS3WYi<2fB*y_0D*V}(7$-RNDTo9KmY>CAb|cQqaG;* z1Rwwb2*e|R{>9@(Y6w680uV?B0rW2!^++io009U4j{YyqYQVIw_00Iz*M*#hc$BWbufB*y_kPHIo zUoz^EQa}I#5P(2D0_a~nUZjQq1Rwx`WDr3Al2MP80s;_#00iO@K>yq2%vxQc##?c5P$##l0g9dOGZ6X3J5>|0uYEt0R4-{ zi_{Q+00bbA3eG6+XA}F00IzzKs*BIUp!uK>w0a zkCXxe5P$##;t@dq;_)Ii1Rwwb2qc35`j?D)q!bW<00bZqj{y1?j~A&S009UeJOb!nJYJ-R z00bZafn*Rs|B_LUlmY?}fB*#I5kUXq@gg+@AOHafB!d9@myCL(6cB&_1RxNP0Qwh? z7pWlt0SG`K83fS3WYi<2fB*y_0D*V}(7$-RNDTo9KmY>CAb|cQqaG;*1Rwwb2*e|R z{>9@(Y6w680uV?B0rW2!^++io009U4j{YyqYQVIw_00Iz*M*#hc$BWbufB*y_kPHIoUoz^EQa}I# z5P(2D0_a~nUZjQq1Rwx`WDr3Al2MP80s;_#00iO@K>yq2%vxQc##?c5P$##l0g9dOGZ6X3J5>|0uYEt0R4-{i_{Q+00bbA z3eG6+XA}F00IzzKs*BIUp!uK>w0akCXxe5P$## z;t@dq;_)Ii1Rwwb2qc35`j?D)q!bW<00bZqj{y1?j~A&S009UmQf@{m=aWS}J7! TNA}gr|N8IC+5f&Y_mBS%KrROi diff --git a/ios_fs/Makefile b/ios_fs/Makefile index f3c29e6..2969d9f 100644 --- a/ios_fs/Makefile +++ b/ios_fs/Makefile @@ -11,9 +11,8 @@ LINK = arm-none-eabi-gcc AS = arm-none-eabi-as OBJCOPY = arm-none-eabi-objcopy OBJDUMP = arm-none-eabi-objdump -CFLAGS += -Wall -mbig-endian -std=gnu11 -mcpu=arm926ej-s -msoft-float -mfloat-abi=soft -Os -LDFLAGS += -nostartfiles -nodefaultlibs -mbig-endian -Wl,-T,link.ld -LIBDIRS += -L$(CURDIR)/../libs +CFLAGS += -Wall -mbig-endian -std=gnu11 -mcpu=arm926ej-s -msoft-float -mfloat-abi=soft -Os -fno-tree-loop-distribute-patterns +LDFLAGS += -nostartfiles -nodefaultlibs -mbig-endian -Wl,-T,link.ld LIBS += -lgcc CFILES = $(wildcard source/*.c) diff --git a/src/dynamic_libs/os_functions.c b/src/dynamic_libs/os_functions.c index ac4df6f..902d79b 100644 --- a/src/dynamic_libs/os_functions.c +++ b/src/dynamic_libs/os_functions.c @@ -69,6 +69,7 @@ EXPORT_DECL(int, OSTryLockMutex, void* mutex); EXPORT_DECL(u64, OSGetTitleID, void); EXPORT_DECL(void, OSGetArgcArgv, int* argc, char*** argv); EXPORT_DECL(void, __Exit, void); +EXPORT_DECL(void, OSSavesDone_ReadyToRelease, void); EXPORT_DECL(void, OSFatal, const char* msg); EXPORT_DECL(void, OSSetExceptionCallback, u8 exceptionType, exception_callback newCallback); EXPORT_DECL(void, DCFlushRange, const void *addr, u32 length); @@ -121,8 +122,8 @@ void InitAcquireOS(void) //!---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- //! Lib handle functions //!---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- - EXPORT_FUNC_WRITE(OSDynLoad_Acquire, (int (*)(const char*, unsigned *))OS_SPECIFICS->addr_OSDynLoad_Acquire); - EXPORT_FUNC_WRITE(OSDynLoad_FindExport, (int (*)(u32, int, const char *, void *))OS_SPECIFICS->addr_OSDynLoad_FindExport); + EXPORT_FUNC_WRITE(OSDynLoad_Acquire, (int (*)(const char*, unsigned *))0x0102A3B4); + EXPORT_FUNC_WRITE(OSDynLoad_FindExport, (int (*)(u32, int, const char *, void *))0x0102B828); OSDynLoad_Acquire("coreinit.rpl", &coreinit_handle); } @@ -144,6 +145,7 @@ void InitOSFunctionPointers(void) OS_FIND_EXPORT(coreinit_handle, OSFatal); OS_FIND_EXPORT(coreinit_handle, OSGetTitleID); OS_FIND_EXPORT(coreinit_handle, OSGetArgcArgv); + OS_FIND_EXPORT(coreinit_handle, OSSavesDone_ReadyToRelease); OS_FIND_EXPORT(coreinit_handle, OSSetExceptionCallback); OS_FIND_EXPORT(coreinit_handle, DCFlushRange); OS_FIND_EXPORT(coreinit_handle, DCStoreRange); diff --git a/src/dynamic_libs/os_functions.h b/src/dynamic_libs/os_functions.h index 0dc7c52..63e6519 100644 --- a/src/dynamic_libs/os_functions.h +++ b/src/dynamic_libs/os_functions.h @@ -111,6 +111,7 @@ extern int (* OSTryLockMutex)(void* mutex); extern u64 (* OSGetTitleID)(void); extern void (* OSGetArgcArgv)(int* argc, char*** argv); extern void (* __Exit)(void); +extern void (* OSSavesDone_ReadyToRelease)(void); extern void (* OSFatal)(const char* msg); extern void (* DCFlushRange)(const void *addr, u32 length); extern void (* DCStoreRange)(const void *addr, u32 length); diff --git a/src/dynamic_libs/proc_ui_functions.c b/src/dynamic_libs/proc_ui_functions.c new file mode 100644 index 0000000..479aa51 --- /dev/null +++ b/src/dynamic_libs/proc_ui_functions.c @@ -0,0 +1,54 @@ +/**************************************************************************** + * Copyright (C) 2015 + * by Dimok + * + * This software is provided 'as-is', without any express or implied + * warranty. In no event will the authors be held liable for any + * damages arising from the use of this software. + * + * Permission is granted to anyone to use this software for any + * purpose, including commercial applications, and to alter it and + * redistribute it freely, subject to the following restrictions: + * + * 1. The origin of this software must not be misrepresented; you + * must not claim that you wrote the original software. If you use + * this software in a product, an acknowledgment in the product + * documentation would be appreciated but is not required. + * + * 2. Altered source versions must be plainly marked as such, and + * must not be misrepresented as being the original software. + * + * 3. This notice may not be removed or altered from any source + * distribution. + ***************************************************************************/ +#include "os_functions.h" +#include "proc_ui_functions.h" + +u32 proc_ui_handle __attribute__((section(".data"))) = 0; + +EXPORT_DECL(void, ProcUIInit, ProcUISaveCallback saveCallback); +EXPORT_DECL(void, ProcUIShutdown); +EXPORT_DECL(void, ProcUIDrawDoneRelease); + +EXPORT_DECL(ProcUIStatus, ProcUIProcessMessages, BOOL block); +EXPORT_DECL(u32, ProcUIInForeground, void); +EXPORT_DECL(void, ProcUIRegisterCallback, u32 type,ProcUICallback callback,void* param, u32 unkwn); + +void InitAcquireProcUI(void) { + if(coreinit_handle == 0) { + InitAcquireOS(); + }; + OSDynLoad_Acquire("proc_ui.rpl", &proc_ui_handle); +} + +void InitProcUIFunctionPointers(void) { + u32 *funcPointer = 0; + InitAcquireProcUI(); + + OS_FIND_EXPORT(proc_ui_handle, ProcUIInForeground); + OS_FIND_EXPORT(proc_ui_handle, ProcUIRegisterCallback); + OS_FIND_EXPORT(proc_ui_handle, ProcUIInit); + OS_FIND_EXPORT(proc_ui_handle, ProcUIDrawDoneRelease); + OS_FIND_EXPORT(proc_ui_handle, ProcUIProcessMessages); + OS_FIND_EXPORT(proc_ui_handle, ProcUIShutdown); +} diff --git a/src/dynamic_libs/proc_ui_functions.h b/src/dynamic_libs/proc_ui_functions.h new file mode 100644 index 0000000..c9a37c2 --- /dev/null +++ b/src/dynamic_libs/proc_ui_functions.h @@ -0,0 +1,66 @@ +/**************************************************************************** + * Copyright (C) 2015 + * by Dimok + * + * This software is provided 'as-is', without any express or implied + * warranty. In no event will the authors be held liable for any + * damages arising from the use of this software. + * + * Permission is granted to anyone to use this software for any + * purpose, including commercial applications, and to alter it and + * redistribute it freely, subject to the following restrictions: + * + * 1. The origin of this software must not be misrepresented; you + * must not claim that you wrote the original software. If you use + * this software in a product, an acknowledgment in the product + * documentation would be appreciated but is not required. + * + * 2. Altered source versions must be plainly marked as such, and + * must not be misrepresented as being the original software. + * + * 3. This notice may not be removed or altered from any source + * distribution. + ***************************************************************************/ +#ifndef __PROC_UI_FUNCTIONS_H_ +#define __PROC_UI_FUNCTIONS_H_ + +#ifdef __cplusplus +extern "C" { +#endif + +#include "os_types.h" + +extern u32 proc_ui_handle; + +typedef u32 (*ProcUICallback)(void*); +typedef void (*ProcUISaveCallback)(void); + +typedef enum ProcUIStatus +{ + //! The application is in the foreground. All resources may be used. + PROCUI_STATUS_IN_FOREGROUND, + //! The application is in the background, only limited resources are usable. + PROCUI_STATUS_IN_BACKGROUND, + //! The application must release the foregound - see ProcUIDrawDoneRelease() + PROCUI_STATUS_RELEASE_FOREGROUND, + //! The application must release all resources (including ProcUI) and quit + PROCUI_STATUS_EXITING, +} ProcUIStatus; + +void InitProcUIFunctionPointers(void); +void InitAcquireProcUI(void); + +extern void (*ProcUIInit)(ProcUISaveCallback saveCallback); +extern void (*ProcUIDrawDoneRelease)(); +extern void (*ProcUIShutdown)(); + +extern ProcUIStatus (*ProcUIProcessMessages)(BOOL block); + +extern u32 (*ProcUIInForeground)(void); +extern void (*ProcUIRegisterCallback)(u32 type,ProcUICallback callback,void* param, u32 unkwn); + +#ifdef __cplusplus +} +#endif + +#endif // __PROC_UI_FUNCTIONS_H_ diff --git a/src/dynamic_libs/socket_functions.h b/src/dynamic_libs/socket_functions.h index 1e4df1a..f87678f 100644 --- a/src/dynamic_libs/socket_functions.h +++ b/src/dynamic_libs/socket_functions.h @@ -33,6 +33,7 @@ extern unsigned int nsysnet_handle; #include #define INADDR_ANY 0 +#define INADDR_BROADCAST 0xFFFFFFFF #define AF_INET 2 @@ -47,6 +48,7 @@ extern unsigned int nsysnet_handle; #define SOL_SOCKET -1 #define SO_REUSEADDR 0x0004 +#define SO_BROADCAST 0x0020 // broadcast #define SO_NONBLOCK 0x1016 #define SO_MYADDR 0x1013 #define SO_RCVTIMEO 0x1006 diff --git a/src/entry.c b/src/entry.c index 759cee0..cb62803 100644 --- a/src/entry.c +++ b/src/entry.c @@ -1,14 +1,140 @@ #include -#include "dynamic_libs/os_functions.h" -#include "dynamic_libs/sys_functions.h" -#include "common/common.h" -#include "utils/utils.h" -#include "main.h" +#include +#include +#include +#include +#include +#include -int __entry_menu(int argc, char **argv) -{ - //! ******************************************************************* - //! * Jump to our application * - //! ******************************************************************* +#include "main.h" +#include "ios_exploit.h" +#define OSDynLoad_Acquire ((void (*)(char* rpl, unsigned int *handle))0x0102A3B4) +#define OSDynLoad_FindExport ((void (*)(unsigned int handle, int isdata, char *symbol, void *address))0x0102B828) +#define OSFatal ((void (*)(char* msg))0x01031618) + +#define EXPORT_DECL(res, func, ...) res (* func)(__VA_ARGS__); +#define OS_FIND_EXPORT(handle, funcName, func) OSDynLoad_FindExport(handle, 0, funcName, &func) + +#define ADDRESS_OSTitle_main_entry_ptr 0x1005E040 +#define ADDRESS_main_entry_hook 0x0101c56c + +#define KERN_SYSCALL_TBL_1 0xFFE84C70 // unknown +#define KERN_SYSCALL_TBL_2 0xFFE85070 // works with games +#define KERN_SYSCALL_TBL_3 0xFFE85470 // works with loader +#define KERN_SYSCALL_TBL_4 0xFFEAAA60 // works with home menu +#define KERN_SYSCALL_TBL_5 0xFFEAAE60 // works with browser (previously KERN_SYSCALL_TBL) + +/* assembly functions */ +extern void Syscall_0x36(void); +extern void KernelPatches(void); +extern void SCKernelCopyData(unsigned int addr, unsigned int src, unsigned int len); + +extern void SC_0x25_KernelCopyData(unsigned int addr, unsigned int src, unsigned int len); + +void __attribute__ ((noinline)) kern_write(void *addr, uint32_t value); + +typedef struct _private_data_t { + EXPORT_DECL(void *, MEMAllocFromDefaultHeapEx,int size, int align); + EXPORT_DECL(void, MEMFreeToDefaultHeap,void *ptr); + + EXPORT_DECL(void*, memcpy, void *p1, const void *p2, unsigned int s); + EXPORT_DECL(void*, memset, void *p1, int val, unsigned int s); + + EXPORT_DECL(unsigned int, OSEffectiveToPhysical, const void*); + EXPORT_DECL(void, exit, int); + EXPORT_DECL(void, DCInvalidateRange, const void *addr, unsigned int length); + EXPORT_DECL(void, DCFlushRange, const void *addr, unsigned int length); + EXPORT_DECL(void, ICInvalidateRange, const void *addr, unsigned int length); + EXPORT_DECL(void, OSForceFullRelaunch); + + EXPORT_DECL(void, SYSRelaunchTitle, int argc, char** argv); + EXPORT_DECL(void, SYSLaunchMenu); +} private_data_t; + + +static void loadFunctionPointers(private_data_t * private_data) { + unsigned int coreinit_handle; + + OSDynLoad_Acquire("coreinit", &coreinit_handle); + + unsigned int *functionPtr = 0; + + OSDynLoad_FindExport(coreinit_handle, 1, "MEMAllocFromDefaultHeapEx", &functionPtr); + private_data->MEMAllocFromDefaultHeapEx = (void * (*)(int, int))*functionPtr; + OSDynLoad_FindExport(coreinit_handle, 1, "MEMFreeToDefaultHeap", &functionPtr); + private_data->MEMFreeToDefaultHeap = (void (*)(void *))*functionPtr; + + OS_FIND_EXPORT(coreinit_handle, "memcpy", private_data->memcpy); + OS_FIND_EXPORT(coreinit_handle, "memset", private_data->memset); + OS_FIND_EXPORT(coreinit_handle, "DCFlushRange", private_data->DCFlushRange); + OS_FIND_EXPORT(coreinit_handle, "DCInvalidateRange", private_data->DCInvalidateRange); + OS_FIND_EXPORT(coreinit_handle, "ICInvalidateRange", private_data->ICInvalidateRange); + OS_FIND_EXPORT(coreinit_handle, "OSEffectiveToPhysical", private_data->OSEffectiveToPhysical); + OS_FIND_EXPORT(coreinit_handle, "OSForceFullRelaunch", private_data->OSForceFullRelaunch); + OS_FIND_EXPORT(coreinit_handle, "exit", private_data->exit); + + unsigned int sysapp_handle; + OSDynLoad_Acquire("sysapp.rpl", &sysapp_handle); + OS_FIND_EXPORT(sysapp_handle, "SYSRelaunchTitle", private_data->SYSRelaunchTitle); + OS_FIND_EXPORT(sysapp_handle, "SYSLaunchMenu", private_data->SYSLaunchMenu); +} + +void KernelWriteU32(uint32_t addr, uint32_t value, private_data_t * pdata) { + pdata->ICInvalidateRange(&value, 4); + pdata->DCFlushRange(&value, 4); + + uint32_t dst = (uint32_t) pdata->OSEffectiveToPhysical((void *)addr); + uint32_t src = (uint32_t) pdata->OSEffectiveToPhysical((void *)&value); + + SC_0x25_KernelCopyData(dst, src, 4); + + pdata->DCFlushRange((void *)addr, 4); + pdata->ICInvalidateRange((void *)addr, 4); +} + +int _start(int argc, char **argv) { + kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x25 * 4)), (unsigned int)SCKernelCopyData); + kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x25 * 4)), (unsigned int)SCKernelCopyData); + kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x25 * 4)), (unsigned int)SCKernelCopyData); + kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x25 * 4)), (unsigned int)SCKernelCopyData); + kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x25 * 4)), (unsigned int)SCKernelCopyData); + + kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x36 * 4)), (unsigned int)KernelPatches); + kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x36 * 4)), (unsigned int)KernelPatches); + kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x36 * 4)), (unsigned int)KernelPatches); + kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x36 * 4)), (unsigned int)KernelPatches); + kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x36 * 4)), (unsigned int)KernelPatches); + + Syscall_0x36(); + + private_data_t private_data; + loadFunctionPointers(&private_data); + + unsigned int repl_addr = ADDRESS_main_entry_hook; + unsigned int bufferU32 = 0x4E800421; + KernelWriteU32(repl_addr,bufferU32,&private_data); + return Menu_Main(); } + +/* Write a 32-bit word with kernel permissions */ +void __attribute__ ((noinline)) kern_write(void *addr, uint32_t value) { + asm volatile ( + "li 3,1\n" + "li 4,0\n" + "mr 5,%1\n" + "li 6,0\n" + "li 7,0\n" + "lis 8,1\n" + "mr 9,%0\n" + "mr %1,1\n" + "li 0,0x3500\n" + "sc\n" + "nop\n" + "mr 1,%1\n" + : + : "r"(addr), "r"(value) + : "memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10", + "11", "12" + ); +} \ No newline at end of file diff --git a/src/ios_exploit.c b/src/ios_exploit.c index 051869b..f457945 100644 --- a/src/ios_exploit.c +++ b/src/ios_exploit.c @@ -13,9 +13,6 @@ #define ARM_CODE_BASE 0x08135000 #define REPLACE_SYSCALL 0x081298BC -extern const u8 launch_image_tga[]; -extern const u32 launch_image_tga_size; - static void uhs_exploit_init(int uhs_handle, cfw_config_t * config); static int uhs_write32(int uhs_handle, int arm_addr, int val); diff --git a/src/kernel_asm.S b/src/kernel_asm.S new file mode 100644 index 0000000..3edc393 --- /dev/null +++ b/src/kernel_asm.S @@ -0,0 +1,239 @@ +.section ".kernel_code" + .globl SaveAndResetDataBATs_And_SRs_hook +SaveAndResetDataBATs_And_SRs_hook: + # setup CTR to the position we need to return to + mflr r5 + mtctr r5 + # set link register to its original value + mtlr r7 + # setup us a nice DBAT for our code data with same region as our code + mfspr r5, 560 + mtspr 570, r5 + mfspr r5, 561 + mtspr 571, r5 + # restore the original kernel instructions that we replaced + lwz r5, 0x34(r3) + lwz r6, 0x38(r3) + lwz r7, 0x3C(r3) + lwz r8, 0x40(r3) + lwz r9, 0x44(r3) + lwz r10, 0x48(r3) + lwz r11, 0x4C(r3) + lwz r3, 0x50(r3) + isync + mtsr 7, r5 + # jump back to the position in kernel after our patch (from LR) + bctr + + +#define BAT_SETUP_HOOK_ADDR 0xFFF1D624 +# not all of those NOP address are required for every firmware +# mainly these should stop the kernel from removing our IBAT4 and DBAT5 +#define BAT_SET_NOP_ADDR_1 0xFFF06B6C +#define BAT_SET_NOP_ADDR_2 0xFFF06BF8 +#define BAT_SET_NOP_ADDR_3 0xFFF003C8 +#define BAT_SET_NOP_ADDR_4 0xFFF003CC +#define BAT_SET_NOP_ADDR_5 0xFFF1D70C +#define BAT_SET_NOP_ADDR_6 0xFFF1D728 +#define BAT_SET_NOP_ADDR_7 0xFFF1D82C + +#define BAT_SET_NOP_ADDR_8 0xFFEE11C4 +#define BAT_SET_NOP_ADDR_9 0xFFEE11C8 + +#define BAT_SETUP_HOOK_ENTRY 0x00800000 + + +#define BAT4U_VAL 0x008000FF +#define BAT4L_VAL 0x30800012 + + +#define SET_R4_TO_ADDR(addr) \ + lis r3, addr@h ; \ + ori r3, r3, addr@l ; \ + stw r4, 0(r3) ; \ + dcbf 0, r3 ; \ + icbi 0, r3 ; + + .globl Syscall_0x36 +Syscall_0x36: + li r0, 0x3600 + sc + blr + + +.global SCKernelCopyData +SCKernelCopyData: + // Disable data address translation + mfmsr %r6 + li %r7, 0x10 + andc %r6, %r6, %r7 + mtmsr %r6 + + // Copy data + addi %r3, %r3, -1 + addi %r4, %r4, -1 + mtctr %r5 +SCKernelCopyData_loop: + lbzu %r5, 1(%r4) + stbu %r5, 1(%r3) + bdnz SCKernelCopyData_loop + + // Enable data address translation + ori %r6, %r6, 0x10 + mtmsr %r6 +blr + +.global SC_0x25_KernelCopyData +SC_0x25_KernelCopyData: + li %r0, 0x2500 + sc +blr + + .globl KernelPatches +KernelPatches: + # store the old DBAT0 + mfdbatu r5, 0 + mfdbatl r6, 0 + + # memory barrier + eieio + isync + + # setup DBAT0 for access to kernel code memory + lis r3, 0xFFF0 + ori r3, r3, 0x0002 + mtdbatu 0, r3 + lis r3, 0xFFF0 + ori r3, r3, 0x0032 + mtdbatl 0, r3 + + # memory barrier + eieio + isync + + # SaveAndResetDataBATs_And_SRs hook setup, but could be any BAT function though + # just chosen because its simple + lis r3, BAT_SETUP_HOOK_ADDR@h + ori r3, r3, BAT_SETUP_HOOK_ADDR@l + + # make the kernel setup our section in IBAT4 and + # jump to our function to restore the replaced instructions + lis r4, 0x3ce0 # lis r7, BAT4L_VAL@h + ori r4, r4, BAT4L_VAL@h + stw r4, 0x00(r3) + lis r4, 0x60e7 # ori r7, r7, BAT4L_VAL@l + ori r4, r4, BAT4L_VAL@l + stw r4, 0x04(r3) + lis r4, 0x7cf1 # mtspr 561, r7 + ori r4, r4, 0x8ba6 + stw r4, 0x08(r3) + lis r4, 0x3ce0 # lis r7, BAT4U_VAL@h + ori r4, r4, BAT4U_VAL@h + stw r4, 0x0C(r3) + lis r4, 0x60e7 # ori r7, r7, BAT4U_VAL@l + ori r4, r4, BAT4U_VAL@l + stw r4, 0x10(r3) + lis r4, 0x7cf0 # mtspr 560, r7 + ori r4, r4, 0x8ba6 + stw r4, 0x14(r3) + lis r4, 0x7c00 # eieio + ori r4, r4, 0x06ac + stw r4, 0x18(r3) + lis r4, 0x4c00 # isync + ori r4, r4, 0x012c + stw r4, 0x1C(r3) + lis r4, 0x7ce8 # mflr r7 + ori r4, r4, 0x02a6 + stw r4, 0x20(r3) + lis r4, (BAT_SETUP_HOOK_ENTRY | 0x48000003)@h # bla BAT_SETUP_HOOK_ENTRY + ori r4, r4, (BAT_SETUP_HOOK_ENTRY | 0x48000003)@l + stw r4, 0x24(r3) + + # flush and invalidate the replaced instructions + lis r3, (BAT_SETUP_HOOK_ADDR & ~31)@h + ori r3, r3, (BAT_SETUP_HOOK_ADDR & ~31)@l + dcbf 0, r3 + icbi 0, r3 + lis r3, ((BAT_SETUP_HOOK_ADDR + 0x20) & ~31)@h + ori r3, r3, ((BAT_SETUP_HOOK_ADDR + 0x20) & ~31)@l + dcbf 0, r3 + icbi 0, r3 + sync + + # setup IBAT4 for core 1 at this position (not really required but wont hurt) + # IBATL 4 + lis r3, BAT4L_VAL@h + ori r3, r3, BAT4L_VAL@l + mtspr 561, r3 + + # IBATU 4 + lis r3, BAT4U_VAL@h + ori r3, r3, BAT4U_VAL@l + mtspr 560, r3 + + # memory barrier + eieio + isync + + # write "nop" to some positions + lis r4, 0x6000 + # nop on IBATU 4 and DBAT 5 set/reset +#ifdef BAT_SET_NOP_ADDR_1 + SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_1) +#endif +#ifdef BAT_SET_NOP_ADDR_2 + SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_2) +#endif +#ifdef BAT_SET_NOP_ADDR_3 + SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_3) +#endif +#ifdef BAT_SET_NOP_ADDR_4 + SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_4) +#endif +#ifdef BAT_SET_NOP_ADDR_5 + SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_5) +#endif +#ifdef BAT_SET_NOP_ADDR_6 + SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_6) +#endif +#ifdef BAT_SET_NOP_ADDR_7 + SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_7) +#endif + +#if (defined(BAT_SET_NOP_ADDR_8) && defined(BAT_SET_NOP_ADDR_9)) + # memory barrier + eieio + isync + + # setup DBAT0 for access to kernel code memory + lis r3, 0xFFEE + ori r3, r3, 0x0002 + mtdbatu 0, r3 + lis r3, 0xFFEE + ori r3, r3, 0x0032 + mtdbatl 0, r3 + + # memory barrier + eieio + isync + + # write "nop" to some positions + lis r4, 0x6000 + SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_8) + SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_9) +#endif + + # memory barrier + eieio + isync + + # restore DBAT 0 and return from interrupt + mtdbatu 0, r5 + mtdbatl 0, r6 + + # memory barrier + eieio + isync + + blr + diff --git a/src/link.ld b/src/link.ld index fc569d1..80ab938 100644 --- a/src/link.ld +++ b/src/link.ld @@ -1,40 +1,25 @@ -OUTPUT(ftpiiu.elf); +OUTPUT(payload.elf); -/* Tell linker where our application entry is so the garbage collect can work correct */ -ENTRY(__entry_menu); +ENTRY(_start); SECTIONS { - . = 0x00802000; + . = 0x00840000; .text : { + *(.kernel_code*); *(.text*); - } - .rodata : { - *(.rodata*); - } + /* Tell linker to not garbage collect this section as it is not referenced anywhere */ + KEEP(*(.kernel_code*)); + } .data : { - *(.data*); - - __sdata_start = .; + *(.rodata*); *(.sdata*); - __sdata_end = .; - - __sdata2_start = .; - *(.sdata2*); - __sdata2_end = .; - } - .bss : { - __bss_start = .; + *(.data*); *(.bss*); *(.sbss*); - *(COMMON); - __bss_end = .; } - __CODE_END = .; - /DISCARD/ : { *(*); } } -/******************************************************** FS ********************************************************/ -/* coreinit.rpl difference in addresses 0xFE3C00 */ +ASSERT((SIZEOF(.text) + SIZEOF(.data)) < 0x7C0000, "elf is too big"); \ No newline at end of file diff --git a/src/main.c b/src/main.c index 2fab0ea..71e6955 100644 --- a/src/main.c +++ b/src/main.c @@ -11,6 +11,7 @@ #include "dynamic_libs/sys_functions.h" #include "dynamic_libs/vpad_functions.h" #include "dynamic_libs/socket_functions.h" +#include "dynamic_libs/proc_ui_functions.h" #include "fs/fs_utils.h" #include "fs/sd_fat_devoptab.h" #include "system/memory.h" @@ -23,6 +24,27 @@ static int exitToHBLOnLaunch = 0; +bool CheckRunning() { + switch (ProcUIProcessMessages(true)) { + case PROCUI_STATUS_EXITING: { + return false; + } + case PROCUI_STATUS_RELEASE_FOREGROUND: { + ProcUIDrawDoneRelease(); + break; + } + case PROCUI_STATUS_IN_FOREGROUND: { + break; + } + case PROCUI_STATUS_IN_BACKGROUND: + default: + break; + } + return true; +} + + + int Menu_Main(void) { //!---------INIT--------- @@ -31,22 +53,10 @@ int Menu_Main(void) InitFSFunctionPointers(); InitSocketFunctionPointers(); InitVPadFunctionPointers(); + InitProcUIFunctionPointers(); u64 currenTitleId = OSGetTitleID(); - // in case we are not in mii maker or HBL channel but in system menu or another channel we need to exit here - if (currenTitleId != 0x000500101004A200 && // mii maker eur - currenTitleId != 0x000500101004A100 && // mii maker usa - currenTitleId != 0x000500101004A000 && // mii maker jpn - currenTitleId != 0x0005000013374842) // HBL channel - { - return EXIT_RELAUNCH_ON_LOAD; - } - else if(exitToHBLOnLaunch) - { - return 0; - } - VPADInit(); /*int forceMenu = 0; @@ -73,30 +83,32 @@ int Menu_Main(void) //{ launch = ShowMenu(&config); //} + + ExecuteIOSExploit(&config); + if ( + OSGetTitleID() == 0x000500101004A200L || // mii maker eur + OSGetTitleID() == 0x000500101004A100L || // mii maker usa + OSGetTitleID() == 0x000500101004A000L) { // mii maker jpn - int returnCode = 0; + // restart mii maker. + OSForceFullRelaunch(); + SYSLaunchMenu(); + exit(0); + } else { + ProcUIInit(OSSavesDone_ReadyToRelease); + + OSForceFullRelaunch(); + SYSLaunchMenu(); - if(launch) - { - int res = ExecuteIOSExploit(&config); - if(res == 0) - { - //if(config.noIosReload == 0) - //{ - OSForceFullRelaunch(); - SYSLaunchMenu(); - returnCode = EXIT_RELAUNCH_ON_LOAD; - //} - //else if(config.launchSysMenu) - //{ - // SYSLaunchMenu(); - // exitToHBLOnLaunch = 1; - // returnCode = EXIT_RELAUNCH_ON_LOAD; - //} + while (CheckRunning()) { + // wait. + OSSleepTicks(MILLISECS_TO_TICKS(100)); } + ProcUIShutdown(); + + return 0; } - //unmount_sd_fat("sd"); - return returnCode; + return 0; } diff --git a/src/utils/logger.c b/src/utils/logger.c index f4795b4..a3b4688 100644 --- a/src/utils/logger.c +++ b/src/utils/logger.c @@ -3,60 +3,46 @@ #include #include #include -#include "common/common.h" -#include "dynamic_libs/os_functions.h" -#include "dynamic_libs/socket_functions.h" #include "logger.h" +#include +#include -#ifdef DEBUG_LOGGER -static int log_socket = -1; -static volatile int log_lock = 0; +static int log_socket __attribute__((section(".data")))= -1; +static struct sockaddr_in connect_addr __attribute__((section(".data"))); +static volatile int log_lock __attribute__((section(".data"))) = 0; +void log_init_() { + InitOSFunctionPointers(); + InitSocketFunctionPointers(); -void log_init(const char * ipString) -{ - log_socket = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); - if (log_socket < 0) - return; + int broadcastEnable = 1; + log_socket = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); + if (log_socket < 0) + return; - struct sockaddr_in connect_addr; - memset(&connect_addr, 0, sizeof(connect_addr)); - connect_addr.sin_family = AF_INET; - connect_addr.sin_port = 4405; - inet_aton(ipString, &connect_addr.sin_addr); + setsockopt(log_socket, SOL_SOCKET, SO_BROADCAST, &broadcastEnable, sizeof(broadcastEnable)); - if(connect(log_socket, (struct sockaddr*)&connect_addr, sizeof(connect_addr)) < 0) - { - socketclose(log_socket); - log_socket = -1; - } + memset(&connect_addr, 0, sizeof(struct sockaddr_in)); + connect_addr.sin_family = AF_INET; + connect_addr.sin_port = 4405; + connect_addr.sin_addr.s_addr = htonl(INADDR_BROADCAST); } -void log_deinit(void) -{ - if(log_socket >= 0) - { - socketclose(log_socket); - log_socket = -1; - } -} - -void log_print(const char *str) -{ +void log_print_(const char *str) { // socket is always 0 initially as it is in the BSS if(log_socket < 0) { return; } while(log_lock) - usleep(1000); + os_usleep(1000); log_lock = 1; int len = strlen(str); int ret; while (len > 0) { int block = len < 1400 ? len : 1400; // take max 1400 bytes per UDP packet - ret = send(log_socket, str, block, 0); + ret = sendto(log_socket, str, block, 0, (struct sockaddr *)&connect_addr, sizeof(struct sockaddr_in)); if(ret < 0) break; @@ -67,23 +53,32 @@ void log_print(const char *str) log_lock = 0; } -void log_printf(const char *format, ...) -{ +void OSFatal_printf(const char *format, ...) { + char * tmp = NULL; + va_list va; + va_start(va, format); + if((vasprintf(&tmp, format, va) >= 0) && tmp) { + OSFatal(tmp); + } + va_end(va); +} + +void log_printf_(const char *format, ...) { if(log_socket < 0) { return; } - char * tmp = NULL; - va_list va; - va_start(va, format); - if((vasprintf(&tmp, format, va) >= 0) && tmp) - { - log_print(tmp); - } - va_end(va); + char * tmp = NULL; - if(tmp) - free(tmp); + va_list va; + va_start(va, format); + if((vasprintf(&tmp, format, va) >= 0) && tmp) { + log_print_(tmp); + } + va_end(va); + + if(tmp) + free(tmp); } -#endif + diff --git a/src/utils/logger.h b/src/utils/logger.h index dd7cc71..32e65b8 100644 --- a/src/utils/logger.h +++ b/src/utils/logger.h @@ -5,19 +5,42 @@ extern "C" { #endif -#define DEBUG_LOGGER 1 +#include + +void log_init_(); +//void log_deinit_(void); +void log_print_(const char *str); +void log_printf_(const char *format, ...); +void OSFatal_printf(const char *format, ...); + +#define __FILENAME_X__ (strrchr(__FILE__, '\\') ? strrchr(__FILE__, '\\') + 1 : __FILE__) +#define __FILENAME__ (strrchr(__FILE__, '/') ? strrchr(__FILE__, '/') + 1 : __FILENAME_X__) + +#define OSFATAL_FUNCTION_LINE(FMT, ARGS...)do { \ + OSFatal_printf("[%s]%s@L%04d: " FMT "",__FILENAME__,__FUNCTION__, __LINE__, ## ARGS); \ + } while (0) + +#ifdef __LOGGING__ + +#define log_init() log_init_() +//#define log_deinit() log_deinit_() +#define log_print(str) log_print_(str) +#define log_printf(FMT, ARGS...) log_printf_(FMT, ## ARGS); + +#define DEBUG_FUNCTION_LINE(FMT, ARGS...)do { \ + log_printf("[%23s]%30s@L%04d: " FMT "",__FILENAME__,__FUNCTION__, __LINE__, ## ARGS); \ + } while (0) + -#ifdef DEBUG_LOGGER -void log_init(const char * ip); -void log_deinit(void); -void log_print(const char *str); -void log_printf(const char *format, ...); #else -#define log_init(x) -#define log_deinit() + +#define log_init() +//#define log_deinit() #define log_print(x) #define log_printf(x, ...) -#endif +#define DEBUG_FUNCTION_LINE(FMT, ARGS...) + +#endif //__LOGGING__ #ifdef __cplusplus }