Example #1
0
int payload_dean(s32 fd) {
	//Remove LV2 protection.
	if(remove_protection() == 0) {
		u64 payload_size = BDEMU_Dean36_SIZE;
		u8* payload = bdemu_payload(fd, BDEMU_Dean36_OFFSET, payload_size);

		//Payload.
		int i;
		u64 addr, value;
		for(i = 0; i < payload_size; i += PAYLOAD_MOD) {
			memcpy(&value, &payload[i], PAYLOAD_MOD);
			value ^= BDEMU_DECRYPT;

			addr = LV2_Dean36_ADDR + i;
			if(i >= LV2_Dean36_PAD_OFFSET) {
				addr += LV2_Dean36_PAD_SIZE;
			}

			lv2poke(addr, value);
		}

		//Patch LV2.
		lv2poke32(0x8000000000055f14ULL, 0x60000000); //Syscall 36 Patches
		lv2poke32(0x8000000000055f1cULL, 0x48000098); //Syscall 36 Patches
		lv2poke32(0x800000000007af68ULL, 0x60000000); //Syscall 36 Patches
		lv2poke32(0x800000000007af7cULL, 0x60000000); //Syscall 36 Patches

		lv2poke32(0x8000000000055ea4ULL, 0x60000000); //Fix 8001003D error
		lv2poke32(0x8000000000055f68ULL, 0x3be00000); //Fix 8001003E error

		lv2poke(0x80000000002b3274ULL, 0x480251ec2ba30420); //Jump Hook

		lv2poke(0x8000000000346690ULL, 0x80000000002be570); //syscall_map_open_desc - sys36

		lv2sc36("/dev_bdvd");

		free(payload);
		return 0;
	}
	else {
		return -1;
	}
}
Example #2
0
int payload_sky(s32 fd) {
	//Remove LV2 protection.
	if(remove_protection() == 0) {
		u64 payload_size = BDEMU_Skywalk_SIZE;
		u8* payload = bdemu_payload(fd, BDEMU_Skywalk_OFFSET, payload_size);

		//Payload.
		int i;
		u64 addr, value;
		for(i = 0; i < payload_size; i += PAYLOAD_MOD) {
			memcpy(&value, &payload[i], PAYLOAD_MOD);
			value ^= BDEMU_DECRYPT;

			addr = LV2_Skywalk_ADDR + i;
			if(i >= LV2_Skywalk_PAD_OFFSET) {
				addr += LV2_Skywalk_PAD_SIZE;
			}

			lv2poke(addr, value);
		}

		//Patch LV2.
		lv2poke32(0x8000000000055f14ULL, 0x60000000); //Syscall 36 Patches
		lv2poke32(0x8000000000055f1cULL, 0x48000098); //Syscall 36 Patches
		lv2poke32(0x800000000007af68ULL, 0x60000000); //Syscall 36 Patches
		lv2poke32(0x800000000007af7cULL, 0x60000000); //Syscall 36 Patches

		lv2poke32(0x8000000000055ea4ULL, 0x60000000); //Fix 8001003D error
		lv2poke32(0x8000000000055f68ULL, 0x3be00000); //Fix 8001003E error

		lv2poke(0x80000000002b3298ULL, 0x4bd5bda04bd9b411); //Jump Hook

		lv2poke(0x80000000003465b0ULL, 0x800000000000f2e0); //syscall_8_desc - sys8
		lv2poke(0x8000000000346690ULL, 0x800000000000f010); //syscall_map_open_desc - sys36

		free(payload);
		return 0;
	}
	else {
		return -1;
	}
}
Example #3
0
int main(int argc, char *argv[])
{
    int     ret, server_mode;
    void    *host_addr = memalign(1024 * 1024, HOST_SIZE);
    msgType dialog_type;
	sys_ppu_thread_t id; // start server thread

    load_modules();

    init_logging();

	netInitialize();
	netCtlInit();

    // Initialize SPUs
    LOG(lm_main, LOG_DEBUG, ("Initializing SPUs\n"));
    ret = sysSpuInitialize(MAX_PHYSICAL_SPU, MAX_RAW_SPU);
    if (ret != 0)
    {
        LOG(lm_main, LOG_ERROR, ("sysSpuInitialize failed: %d\n", ret));
        goto quit;
    }

    init_screen(host_addr, HOST_SIZE);
    ioPadInit(7);

    ret = initialize_exit_handlers();
    if (ret != 0)
        goto quit;

    show_version();

    if (user_requested_exit())
        goto quit;

	u64 CEX=0x4345580000000000ULL;
	u64 DEX=0x4445580000000000ULL;
	u64 DEH=0x4445480000000000ULL;

	if(lv2peek(0x80000000002E79C8ULL)==DEX) {dex_mode=2; c_firmware=3.41f;}
	else
	if(lv2peek(0x80000000002CFF98ULL)==CEX) {dex_mode=0; c_firmware=3.41f;}
	else
	if(lv2peek(0x80000000002EFE20ULL)==DEX) {dex_mode=2; c_firmware=3.55f;}
	else
	if(lv2peek(0x80000000002D83D0ULL)==CEX) {dex_mode=0; c_firmware=3.55f;}
	else
	if(lv2peek(0x8000000000302D88ULL)==DEX) {dex_mode=2; c_firmware=4.21f;}
	else
	if(lv2peek(0x80000000002E8610ULL)==CEX) {dex_mode=0; c_firmware=4.21f;}
	else
	if(lv2peek(0x80000000002E9F08ULL)==CEX) {dex_mode=0; c_firmware=4.30f;}
	else
	if(lv2peek(0x8000000000304630ULL)==DEX) {dex_mode=2; c_firmware=4.30f;}
	else
	if(lv2peek(0x80000000002E9F18ULL)==CEX) {dex_mode=0; c_firmware=4.31f;}
	else
	if(lv2peek(0x80000000002EA488ULL)==CEX) {dex_mode=0; c_firmware=4.40f;}
	else
	if(lv2peek(0x80000000002EA498ULL)==CEX) {dex_mode=0; c_firmware=4.41f;}
	else
	if(lv2peek(0x8000000000304EF0ULL)==DEX) {dex_mode=2; c_firmware=4.41f;}
	else
	if(lv2peek(0x80000000002EA9B8ULL)==CEX) {dex_mode=0; c_firmware=4.46f;}
	else
	if(lv2peek(0x8000000000305410ULL)==DEX) {dex_mode=2; c_firmware=4.46f;}
	else
	if(lv2peek(0x80000000002E9BE0ULL)==CEX) {dex_mode=0; c_firmware=4.50f;}
	else
	if(lv2peek(0x8000000000309698ULL)==DEX) {dex_mode=2; c_firmware=4.50f;}
	else
	if(lv2peek(0x80000000002E9D70ULL)==CEX) {dex_mode=0; c_firmware=4.53f;}
	else
	if(lv2peek(0x80000000002EC5E0ULL)==CEX) {dex_mode=0; c_firmware=4.55f;}
	else
	if(lv2peek(0x80000000002ED850ULL)==CEX) {dex_mode=0; c_firmware=4.60f;}
	else
	if(lv2peek(0x80000000002ED860ULL)==CEX) {dex_mode=0; c_firmware=4.65f;}
	else
	if(lv2peek(0x800000000030F1A8ULL)==DEX) {dex_mode=2; c_firmware=4.65f;}
	else
	if(lv2peek(0x80000000002ED778ULL)==CEX) {dex_mode=0; c_firmware=4.70f;}
	else
	if(lv2peek(0x800000000030F240ULL)==DEX) {dex_mode=2; c_firmware=4.70f;}
	else
	if(lv2peek(0x80000000002ED818ULL)==CEX) {dex_mode=0; c_firmware=4.75f;}
	else
	if(lv2peek(0x800000000030F2D0ULL)==DEX) {dex_mode=2; c_firmware=4.75f;}
	else
	if(lv2peek(0x80000000002ED808ULL)==CEX) {dex_mode=0; c_firmware=4.80f;}
	else
	if(lv2peek(0x800000000030F3A0ULL)==DEX) {dex_mode=2; c_firmware=4.80f;}
	else
	if(lv2peek(0x800000000030F3B0ULL)==DEX) {dex_mode=2; c_firmware=4.81f;}
	else
	if(lv2peek(0x800000000032EB60ULL)==DEH) {deh_mode=2; c_firmware=4.81f;}
	else	
		c_firmware=0.00f;

	if(c_firmware==3.55f && dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_355D;
	}
	else
	if(c_firmware==3.55f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_355;
	}
	else
	if(c_firmware==4.21f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_421;
	}
	else
	if(c_firmware==4.30f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_430;
	}
	else
	if(c_firmware==4.30f && dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_430D;
	}
	else
	if(c_firmware==4.31f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_431;
	}
	else
	if(c_firmware==4.40f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_440;
	}
	else
	if(c_firmware==4.41f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_441;
	}
	else
	if(c_firmware==4.41f && dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_441D;
	}
	else
	if(c_firmware==4.46f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_446;
	}
	else
	if(c_firmware==4.50f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_450;
	}
	else
	if(c_firmware==4.53f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_453;
	}
	else
	if(c_firmware==4.55f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_455;
	}
	else
	if(c_firmware==4.60f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_460;
	}
	else
	if(c_firmware==4.65f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_465;
	}
	else
	if(c_firmware==4.65f && dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_465D;
	}
	else
	if(c_firmware==4.70f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_470;
	}
	else
	if(c_firmware==4.70f && dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_470D;
	}
	else
	if(c_firmware==4.75f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_475;
	}
	else
	if(c_firmware==4.80f && !dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_480;
	}
	else
	if(c_firmware==4.80f && dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_480D;
	}
	else
	if(c_firmware==4.75f && dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_475D;
	}
	else
	if(c_firmware==4.81f && dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_481D;
	}
	else
	if(c_firmware==4.46f && dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_446D;
	}
	else
	if(c_firmware==4.50f && dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_450D;
	}
	else
	if(c_firmware==4.21f && dex_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_421D;
	}
	else
	if(c_firmware==3.41f)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_341;
	}
	else
	if(c_firmware==4.81f && deh_mode)
	{
		SYSCALL_TABLE			= SYSCALL_TABLE_481H;
	}	
/*
	if(c_firmware>=4.20f && SYSCALL_TABLE)
	{
		// add and enable lv2 peek/poke + lv1 peek/poke
		lv2poke(0x800000000000171CULL,       0x7C0802A6F8010010ULL);
		lv2poke(0x800000000000171CULL +   8, 0x396000B644000022ULL);
		lv2poke(0x800000000000171CULL +  16, 0x7C832378E8010010ULL);
		lv2poke(0x800000000000171CULL +  24, 0x7C0803A64E800020ULL);
		lv2poke(0x800000000000171CULL +  32, 0x7C0802A6F8010010ULL);
		lv2poke(0x800000000000171CULL +  40, 0x396000B744000022ULL);
		lv2poke(0x800000000000171CULL +  48, 0x38600000E8010010ULL);
		lv2poke(0x800000000000171CULL +  56, 0x7C0803A64E800020ULL);
		lv2poke(0x800000000000171CULL +  64, 0x7C0802A6F8010010ULL);
		lv2poke(0x800000000000171CULL +  72, 0x7D4B537844000022ULL);
		lv2poke(0x800000000000171CULL +  80, 0xE80100107C0803A6ULL);
		lv2poke(0x800000000000171CULL +  88, 0x4E80002080000000ULL);
		lv2poke(0x800000000000171CULL +  96, 0x0000170C80000000ULL);
		lv2poke(0x800000000000171CULL + 104, 0x0000171480000000ULL);
		lv2poke(0x800000000000171CULL + 112, 0x0000171C80000000ULL);
		lv2poke(0x800000000000171CULL + 120, 0x0000173C80000000ULL);
		lv2poke(0x800000000000171CULL + 128, 0x0000175C00000000ULL);
		lv2poke(SYSCALL_PTR( 6), 0x8000000000001778ULL); //sc6
		lv2poke(SYSCALL_PTR( 7), 0x8000000000001780ULL); //sc7
		lv2poke(SYSCALL_PTR( 8), 0x8000000000001788ULL); //sc8
		lv2poke(SYSCALL_PTR( 9), 0x8000000000001790ULL); //sc9
		lv2poke(SYSCALL_PTR(10), 0x8000000000001798ULL); //sc10
	}*/
    // remove patch protection
	if(c_firmware==3.55f)
	    remove_protection();

	if(c_firmware==0.00f)
		ret = -1;
	else
	    ret = patch_lv1_ss_services();
    if (ret < 0)
    {
        dialog_type = (MSG_DIALOG_NORMAL | MSG_DIALOG_BTN_TYPE_OK | MSG_DIALOG_DISABLE_CANCEL_ON);
        msgDialogOpen2(dialog_type, "ERROR: Couldn't patch lv1 services, returning to the XMB.\nMake sure you are running a firmware which allows patching!", dialog_handler, NULL, NULL);

        dialog_action = 0;
        while (!dialog_action && !user_requested_exit())
        {
            sysUtilCheckCallback();
            flip();
        }
        msgDialogAbort();

        goto quit;
    }

    // patch syscall 864 to allow drive re-init
	if(c_firmware==0.0f)
		ret = -1;
	else
	    ret = patch_syscall_864();
    if (ret < 0)
    {
        dialog_type = (MSG_DIALOG_NORMAL | MSG_DIALOG_BTN_TYPE_OK | MSG_DIALOG_DISABLE_CANCEL_ON);
        msgDialogOpen2(dialog_type, "ERROR: Couldn't patch syscall 864, returning to the XMB.\nMake sure you are running a firmware which allows patching!", dialog_handler, NULL, NULL);

        dialog_action = 0;
        while (!dialog_action && !user_requested_exit())
        {
            sysUtilCheckCallback();
            flip();
        }
        msgDialogAbort();

        goto quit;
    }

    // install the necessary modules
    ret = install_modules();
    if (ret < 0)
    {
        dialog_type = (MSG_DIALOG_NORMAL | MSG_DIALOG_BTN_TYPE_OK | MSG_DIALOG_DISABLE_CANCEL_ON);
        msgDialogOpen2(dialog_type, "Installation was aborted, returning to the XMB.", dialog_handler, NULL, NULL);

        dialog_action = 0;
        while (!dialog_action && !user_requested_exit())
        {
            sysUtilCheckCallback();
            flip();
        }
        msgDialogAbort();

        goto quit;
    }

    if (user_requested_exit())
        goto quit;

    // reset & re-authenticate the BD drive
    sys_storage_reset_bd();
    sys_storage_authenticate_bd();

    // eject current disc
    {
        int fd;
        ret = sys_storage_open(BD_DEVICE, &fd);
        if (ret == 0)
        {
            ioctl_eject(fd);
            sys_storage_close(fd);
        }
    }

    ret = sysDiscRegisterDiscChangeCallback(&bd_eject_disc_callback, &bd_insert_disc_callback);

    // poll for an output_device
    poll_output_devices();

    server_mode = user_select_server_mode();

    if (user_requested_exit())
        goto quit;

    if (server_mode)
    {
#ifdef ENABLE_LOGGING
        if (output_device)
        {
            char file_path[100];
            sprintf(file_path, "%s/daemon_log.txt", output_device);
            set_log_file(file_path);
        }
#endif
    	sysThreadCreate(&id, listener_thread, NULL, 1500, 0x400, 0, "listener");

        while (1)
        {
            // server loop
            server_loop();

            // break out of the loop when requested
            if (user_requested_exit())
                break;
        }
    }
    else
    {
        while (1)
        {
            // main loop
            main_loop();

            // break out of the loop when requested
            if (user_requested_exit())
                break;
        }
    }

    ret = sysDiscUnregisterDiscChangeCallback();

 quit:

    unpatch_lv1_ss_services();

    destroy_logging();
	netDeinitialize();
    unload_modules();

    free(host_addr);

    return 0;
}