Skip to content

Commit 9cd3b78

Browse files
hitodamahitodama
committed
kernel hooks, renaming
1 parent f0b45a4 commit 9cd3b78

File tree

10 files changed

+182
-3
lines changed

10 files changed

+182
-3
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
**/build/
22
**/bin/
3+
scratch

libps4/protected_memory/Makefile renamed to kernel/hook/Makefile

File renamed without changes.

‎kernel/hook/source/main.c‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
#define _WANT_UCRED
2+
#define _XOPEN_SOURCE 700
3+
#define __BSD_VISIBLE 1
4+
5+
#include <stdlib.h>
6+
#include <stdio.h>
7+
#include <string.h>
8+
#include <unistd.h>
9+
#include <sys/syscall.h>
10+
11+
//#include <sys/sysproto.h>
12+
13+
#include <ps4/kernel.h>
14+
#include <ps4/kern.h>
15+
#include <ps4/payload.h>
16+
17+
#include <float.h>
18+
19+
// auto root on jit ^^'
20+
int hook1(void *td, Ps4KernFunctionHookArgument *uap)
21+
{
22+
//ps4KernPrivilegeRoot();
23+
__asm__ volatile(" \
24+
movq %gs:0, %rax; \n \
25+
mov 0x8(%rax),%rax \n \
26+
mov 0x40(%rax),%rax \n \
27+
movl $0x0,0x14(%rax) \n \
28+
movq $0x0,0x4(%rax) \n \
29+
");
30+
//uap->arguments->rax = 0; // return OK
31+
//return PS4_KERN_FUNCTION_HOOK_RETURN; // intercept call
32+
return PS4_KERN_FUNCTION_HOOK_CONTINUE; // next hook
33+
}
34+
35+
int hook2(void *td, Ps4KernFunctionHookArgument *uap)
36+
{
37+
// unroot
38+
uap->arguments->rax = 0; // return OK
39+
return PS4_KERN_FUNCTION_HOOK_RETURN; // intercept call
40+
}
41+
42+
void printHook(Ps4KernelFunctionHook *h)
43+
{
44+
Ps4KernFunctionHookArgument *arg = (Ps4KernFunctionHookArgument *)h;
45+
Ps4KernFunctionHookArgument a;
46+
ps4KernelMemoryCopy(arg, &a, sizeof(Ps4KernFunctionHookArgument));
47+
arg = &a;
48+
printf("[%p %p %p %p]\n[%p %p %p %p]\n[%p %p %p %p]\n[%p %p %p %p]\n",
49+
arg->function,
50+
arg->hook,
51+
arg->hookCurrent,
52+
arg->hookCount,
53+
arg->hookSize,
54+
55+
arg->bridge,
56+
arg->bridgeCopiedSize,
57+
arg->arguments,
58+
59+
arg->locked,
60+
arg->reserved1,
61+
arg->entryCount,
62+
arg->callCount,
63+
64+
arg->returnTo,
65+
arg->r12,
66+
arg->stage1,
67+
arg->stage0);
68+
void *hook[arg->hookSize];
69+
ps4KernelMemoryCopy(arg->hook, hook, arg->hookSize * sizeof(void *));
70+
for(int i = 0; i < arg->hookSize; ++i)
71+
printf("-> %p\n", hook[i]);
72+
}
73+
74+
int main(int argc, char **argv)
75+
{
76+
void *a = ps4KernelDlSym("sceSblACMgrIsJitApplicationProcess");
77+
int r = 0;
78+
size_t s = 0;
79+
Ps4KernelFunctionHook *hh;
80+
void *h1, *h2;
81+
82+
h1 = ps4KernelMemoryMalloc(128);
83+
printf("ps4KernelMemoryMalloc: %p\n", h1);
84+
ps4KernelMemoryCopy((void *)hook1, h1, 128);
85+
printf("ps4KernelMemoryCopy: %p %p\n", hook1, h1);
86+
87+
h2 = ps4KernelMemoryMalloc(128);
88+
printf("ps4KernelMemoryMalloc: %p\n", h2);
89+
ps4KernelMemoryCopy((void *)hook2, h2, 128);
90+
printf("ps4KernelMemoryCopy: %p %p\n", hook2, h2);
91+
92+
s = 12;
93+
r = ps4KernelAssemblerInstructionSeek(a, &s);
94+
printf("ps4KernelAssemblerInstructionSeek: %i %zu\n", r, s);
95+
96+
r = ps4KernelFunctionIsHooked(a);
97+
printf("ps4KernelFunctionIsHooked: %i %p\n", r, a);
98+
99+
r = ps4KernelFunctionGetHook(a, &hh);
100+
printf("ps4KernelFunctionGetHook: %i %p %p\n", r, &hh, hh);
101+
102+
sleep(2);
103+
104+
r = ps4KernelFunctionHookCreateSized(&hh, a, h2, s);
105+
printf("ps4KernelFunctionHookCreateSized: %i %p %p %p %p %zu\n", r, &hh, hh, a, h2, s);
106+
107+
printHook(hh);
108+
printf("uid: %zu\n", getuid());
109+
for(int i = 0; i < 10; ++i)
110+
{
111+
syscall(SYS_jitshm_create, 0, 0, 0, 0, 0);
112+
printf("SYS_jitshm_create\n");
113+
}
114+
printHook(hh);
115+
printf("no root? -> uid: %zu\n", getuid());
116+
117+
r = ps4KernelFunctionIsHooked(a);
118+
printf("ps4KernelFunctionIsHooked: %i %p\n", r, a);
119+
120+
hh = NULL;
121+
r = ps4KernelFunctionGetHook(a, &hh);
122+
printf("ps4KernelFunctionGetHook: %i %p %p\n", r, &hh, hh);
123+
124+
sleep(2);
125+
126+
r = ps4KernelFunctionHookAdd(hh, h1);
127+
printf("ps4KernelFunctionHookAdd: %i %p %p %p\n", r, &hh, hh, h1);
128+
129+
syscall(SYS_jitshm_create, 0, 0, 0, 0, 0);
130+
printHook(hh);
131+
printf("no root? -> uid: %zu\n", getuid());
132+
133+
r = ps4KernelFunctionHookRemove(hh, h2);
134+
printf("ps4KernelFunctionHookRemove: %i %p %p %p\n", r, &hh, hh, h2);
135+
136+
syscall(SYS_jitshm_create, 0, 0, 0, 0, 0);
137+
printHook(hh);
138+
printf("root because h1 intercept gone? -> uid: %zu\n", getuid());
139+
140+
r = ps4KernelFunctionHookAdd(hh, h1);
141+
printf("ps4KernelFunctionHookAdd: %i %p %p %p\n", r, &hh, hh, h1);
142+
143+
syscall(SYS_jitshm_create, 0, 0, 0, 0, 0);
144+
printHook(hh);
145+
printf("uid: %zu\n", getuid());
146+
147+
r = ps4KernelFunctionHookAdd(hh, h2);
148+
printf("ps4KernelFunctionHookAdd: %i %p %p %p\n", r, &hh, hh, h2);
149+
150+
syscall(SYS_jitshm_create, 0, 0, 0, 0, 0);
151+
printHook(hh);
152+
printf("uid: %zu\n", getuid());
153+
printf("current should be 1 - intercept by first h1\n");
154+
155+
r = ps4KernelFunctionUnhook(a);
156+
printf("ps4KernelFunctionUnhook: %i %p\n", r, a);
157+
158+
ps4KernelMemoryFree(h2);
159+
ps4KernelMemoryFree(h1);
160+
161+
return EXIT_SUCCESS;
162+
}

‎kernel/kernel_run/source/kmain.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,9 @@ int kmain(struct thread *td, void *uap)
4747
int kmain2(struct thread *td, void *uap)
4848
{
4949
RunnableInt sceSblACMgrIsVideoplayerProcess = (RunnableInt)ps4KernelDlSym("sceSblACMgrIsVideoplayerProcess");
50-
ps4KernelFunctionPatchToTruth((void *)sceSblACMgrIsVideoplayerProcess);
51-
50+
ps4KernelFunctionPatchToReturn((void *)sceSblACMgrIsVideoplayerProcess, 0);
51+
//size_t s = 0;
52+
//int r = ps4KernelAssemblerInstructionNext(sceSblACMgrIsVideoplayerProcess, &s);
5253
//ps4KernThreadSetReturn0(td, sceSblACMgrIsVideoplayerProcess()); // important notice from kernel!
5354
return 0;
5455
}
@@ -57,7 +58,7 @@ int kmain3(struct thread *td, void *uap)
5758
{
5859
RunnableInt sceSblACMgrIsVideoplayerProcess = (RunnableInt)ps4KernelDlSym("sceSblACMgrIsVideoplayerProcess");
5960
void *sceSblACMgrIsShellcoreProcess = ps4KernelDlSym("sceSblACMgrIsShellcoreProcess");
60-
ps4KernelFunctionPatchToJumpTo((void *)sceSblACMgrIsVideoplayerProcess, sceSblACMgrIsShellcoreProcess);
61+
ps4KernelFunctionPatchToJump((void *)sceSblACMgrIsVideoplayerProcess, sceSblACMgrIsShellcoreProcess);
6162

6263
//ps4KernThreadSetReturn0(td, sceSblACMgrIsVideoplayerProcess());
6364
return 0;

libps4/shared_memory/Makefile renamed to ps4sdk/protected_memory/Makefile

File renamed without changes.

libps4/protected_memory/source/main.c renamed to ps4sdk/protected_memory/source/main.c

File renamed without changes.

libps4/resolve_intercept/Makefile renamed to ps4sdk/resolve_intercept/Makefile

File renamed without changes.

libps4/resolve_intercept/source/main.c renamed to ps4sdk/resolve_intercept/source/main.c

File renamed without changes.

‎ps4sdk/shared_memory/Makefile‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
ifndef Ps4Sdk
2+
ifdef ps4sdk
3+
Ps4Sdk := $(ps4sdk)
4+
endif
5+
ifdef PS4SDK
6+
Ps4Sdk := $(PS4SDK)
7+
endif
8+
ifndef Ps4Sdk
9+
$(error Neither PS4SDK, Ps4Sdk nor ps4sdk set)
10+
endif
11+
endif
12+
13+
target ?= ps4_elf
14+
15+
include $(Ps4Sdk)/make/ps4sdk.mk

libps4/shared_memory/source/main.c renamed to ps4sdk/shared_memory/source/main.c

File renamed without changes.

0 commit comments

Comments
 (0)