void wifiModulesPatch1() { tSceModule * pMod = ( tSceModule * )sceKernelFindModuleByName( "sceThreadManager" ); //a0 = 4, change partition id to 4 if ( fw_version == FW_371 ) threadman_offset = 0x00010B30; else if ( fw_version == FW_380 || fw_version == FW_390 ) threadman_offset = 0x00010CB8; else if ( fw_version == FW_401 ) threadman_offset = 0x00012154; else if ( fw_version == FW_500 || fw_version == FW_550 ) threadman_offset = 0x000121E0; _sw( 0x34040004, pMod->text_addr + threadman_offset ); pMod = ( tSceModule * )sceKernelFindModuleByName( "sceModuleManager" ); //a3 stack size 0x40000 -> 0x10000 if ( fw_version == FW_371 ) modulemgr_offset = 0x000076A0; else if ( fw_version == FW_380 || fw_version == FW_390 ) modulemgr_offset = 0x00007C9C; else if ( fw_version == FW_401 ) modulemgr_offset = 0x00007C50; else if ( fw_version == FW_500 ) modulemgr_offset = 0x00007C84; //added for 5.50 else if ( fw_version == FW_550 ) modulemgr_offset = 0x00007F80; _sw( 0x3C070001, pMod->text_addr + modulemgr_offset ); sceKernelIcacheInvalidateAll(); sceKernelDcacheWritebackInvalidateAll(); }
void wifiModulesPatch2() { if ( fw_version == FW_550 ) { //module renamed to sceNet_Service in 5.50 tSceModule * pMod = ( tSceModule * )sceKernelFindModuleByName( "sceNet_Service" ); //a2 partid = 4 of ifhandle _sw( 0x34050004, pMod->text_addr + 0x000014D8 ); //for 5.50 } else { tSceModule * pMod = ( tSceModule * )sceKernelFindModuleByName( "sceNetInterface_Service" ); _sw( 0x34050004, pMod->text_addr + 0x00001440 ); //for 3.71, 3.80, 3.90, 4.01, 5.00 } tSceModule * pMod = ( tSceModule * )sceKernelFindModuleByName( "sceNet_Library" ); unsigned int net_offset = 0; if ( fw_version == FW_371 || fw_version == FW_380 || fw_version == FW_390 ) net_offset = 0x00001800; else if ( fw_version == FW_401 ) net_offset = 0x00002320; else if ( fw_version == FW_500 || fw_version == FW_550 ) net_offset = 0x00002348; _sw( 0x34020002, pMod->text_addr + net_offset ); _sw( 0xAFA20000, pMod->text_addr + net_offset + 0x4 ); _sw( 0x3C020000, pMod->text_addr + net_offset + 0xC ); pMod = ( tSceModule * )sceKernelFindModuleByName( "sceModuleManager" ); //a3 stack size 0x10000 -> 0x4000 _sw( 0x34074000, pMod->text_addr + modulemgr_offset ); sceKernelIcacheInvalidateAll(); sceKernelDcacheWritebackInvalidateAll(); }
void wifiModulesPatch3() { tSceModule * pMod = ( tSceModule * )sceKernelFindModuleByName( "sceModuleManager" ); //restore _sw( 0x02403821, pMod->text_addr + modulemgr_offset ); pMod = ( tSceModule * )sceKernelFindModuleByName( "sceThreadManager" ); //restore _sw( 0x02402021, pMod->text_addr + threadman_offset ); sceKernelIcacheInvalidateAll(); sceKernelDcacheWritebackInvalidateAll(); }
int unload_loader(void) { SceModule *mod; SceUID modid; int ret = 0; int status; mod = sceKernelFindModuleByName(BOOTLOADER_NAME); if(mod != NULL) { DEBUG_PRINTF("Loader UID: %08X\n", mod->modid); /* Stop module */ modid = mod->modid; ret = sceKernelStopModule(modid, 0, NULL, &status, NULL); if(ret >= 0) { ret = sceKernelUnloadModule(modid); } } else { Kprintf("Couldn't find bootloader\n"); } return 0; }
void patchMemPartitionInfo() { if ( model == PSP_MODEL_STANDARD ) sceKernelSetDdrMemoryProtection( ( void * )0x88300000, 0x00100000, 0xf ); else sceKernelSetDdrMemoryProtection( ( void * )0x88600000, 0x00200000, 0xf ); tSceModule * pMod = ( tSceModule * )sceKernelFindModuleByName( "sceSystemMemoryManager" ); // 0x02001021 move $v0 $s0 int offset = 0x00001304; if ( fw_version == FW_371 || fw_version == FW_380 || fw_version == FW_390 ) { offset = 0x00001304; //for 3.71, 3.80, 3.90 } else if ( fw_version == FW_401 ) { offset = 0x00003A68; //for 4.01 } else if ( fw_version == FW_500 || fw_version == FW_550 ) { offset = 0x00003AA8; //for 5.00 } _sw( 0x02001021, pMod->text_addr + offset ); sceKernelIcacheInvalidateAll(); sceKernelDcacheWritebackInvalidateAll(); PspSysmemPartitionInfo info; memset( &info, 0, sizeof( PspSysmemPartitionInfo ) ); info.size = sizeof( PspSysmemPartitionInfo ); PspSysmemPartitionInfo * p_info = ( PspSysmemPartitionInfo * )sceKernelQueryMemoryPartitionInfo( 4, &info ); if ( model == PSP_MODEL_STANDARD ) p_info->startaddr = 0x08300000; else p_info->startaddr = 0x08600000; p_info->attr = 0xf; //restore _sw( 0x00001021, pMod->text_addr + offset ); sceKernelIcacheInvalidateAll(); sceKernelDcacheWritebackInvalidateAll(); }
SceOff myNpDrmEdataGetDataSize(SceUID fd) { SceOff end; if (sceKernelFindModuleByName("scePspNpDrm_Driver") == NULL) { end = 0x8002013A; goto exit; } if (is_nodrm_fd(fd)) { SceOff off; off = sceIoLseek(fd, 0, PSP_SEEK_CUR); end = sceIoLseek(fd, 0, PSP_SEEK_END); sceIoLseek(fd, off, PSP_SEEK_SET); } else { if (_sceNpDrmEdataGetDataSize != NULL) { end = (*_sceNpDrmEdataGetDataSize)(fd); } else { end = 0x8002013A; } } exit: printk("%s 0x%08X -> 0x%08X\n", __func__, fd, (uint)end); return end; }
int module_start_handler(SceModule2 * module) { kprintf("> Loaded, text_addr: %08X, entry_addr: %08X, name: %s\n", module->text_addr, module->entry_addr, module->modname); if (!module_found && (module->text_addr == 0x08804000 || // base address for game eboots module->text_addr == 0x08900000) && // new games seems to load at this address module->entry_addr != 0xFFFFFFFF && // skip some user mode prx that loads @ 0x08804000 strcmp(module->modname, "opnssmp")){ // this loads @ 0x08804000 too //blacklist the Prometheus iso loader if (!loader_found && (!strcmp(module->modname, "PLoaderGUI"))) { kprintf("Prometheus loader found\n"); loader_found = 1; } else { kprintf("Game found: %s\n", module->modname); patch_drm(module); strcpy(modname, module->modname); module_found = 1; } } if (module_found && !strcmp(module->modname, "scePspNpDrm_Driver")) { SceModule2 *mod = (SceModule2 *) sceKernelFindModuleByName(modname); kprintf("> Late scePspNpDrm load, hooking\n"); // some games reload scePspNpDrm and it could change address so we need to re-hook patch_drm(mod); } return previous ? previous(module) : 0; }
/*------------------------------------------------------------------------------*/ void hookInterrupt( void ) { SceModule *module = sceKernelFindModuleByName( "sceInterruptManager" ); if ( module == NULL ){ return; } if ( sceKernelRegisterSubIntrHandler_Func == NULL ){ sceKernelRegisterSubIntrHandler_Func = HookNidAddress( module, "InterruptManager", 0xCA04A2B9 ); void *hook_addr = HookSyscallAddress( sceKernelRegisterSubIntrHandler_Func ); HookFuncSetting( hook_addr, MyKernelRegisterSubIntrHandler ); } }
unsigned long FindProc(const char *szMod, const char *szLib, unsigned long nid) { unsigned int k = pspSdkSetK1(0); struct SceLibraryEntryTable *entry; SceModule *pMod; void *entTab; int entLen; pMod = (SceModule *) sceKernelFindModuleByName(szMod); if (!pMod) { Kprintf("Cannot find module %s\n", szMod); pspSdkSetK1(k); return 0; } int i = 0; entTab = pMod->ent_top; entLen = pMod->ent_size; while (i < entLen) { int count; int total; u32 *vars; entry = (struct SceLibraryEntryTable *) (entTab + i); if (entry->libname && !strcmp(entry->libname, szLib)) { total = entry->stubcount + entry->vstubcount; vars = entry->entrytable; if (entry->stubcount > 0) { for (count = 0; count < entry->stubcount; count++) { if (vars[count] == nid) { pspSdkSetK1(k); return vars[count + total]; } } } } i += (entry->len * 4); } pspSdkSetK1(k); return 0; }
unsigned int getFindDriverAddr( void ) { tSceModule * pMod = ( tSceModule * )sceKernelFindModuleByName( "sceIOFileManager" ); unsigned int addr = 0; if ( !pMod ) return 0; if ( fw_version == FW_371 ) addr = pMod->text_addr + 0x00002844; else if ( fw_version == FW_380 || fw_version == FW_390 ) addr = pMod->text_addr + 0x00002808; else if ( fw_version == FW_401 ) addr = pMod->text_addr + 0x000027EC; else if ( fw_version == FW_500 || fw_version == FW_550 ) addr = pMod->text_addr + 0x00002838; return addr; }
/*------------------------------------------------------------------------------*/ void hookUsbFunc( void ) { SceModule *module = sceKernelFindModuleByName( "sceUSB_Driver" ); if ( module == NULL ){ return; } if ( sceUsbStart_Func == NULL ){ sceUsbStart_Func = HookNidAddress( module, "sceUsb", 0xAE5DE6AF ); void *hook_addr = HookSyscallAddress( sceUsbStart_Func ); HookFuncSetting( hook_addr, MyUsbStart ); } if ( sceUsbStop_Func == NULL ){ sceUsbStop_Func = HookNidAddress( module, "sceUsb", 0xC2464FA0 ); void *hook_addr = HookSyscallAddress( sceUsbStop_Func ); HookFuncSetting( hook_addr, MyUsbStop ); } }
int launcher_thread(SceSize args, void *argp) { int status = 0; // Unload the launcher SceModule2* mod = (SceModule2*)sceKernelFindModuleByName("launcher"); int result = sceKernelStopModule(mod->modid, 0, NULL, &status, NULL); result = sceKernelUnloadModule(mod->modid); // Load the game engine SceUID modid = sceKernelLoadModule(exefile, 0, NULL); sceKernelStartModule(modid, paramlength, parameters, &status, NULL); // Unload this module sceKernelSelfStopUnloadModule(1, 0, NULL); return 0; }
// 0x000003D8 int myKernelStartThread(SceUID thid, SceSize arglen, void *argp) { if(g_SceNpUmdMount_thid == thid) { SceModule2 *pMod; pMod = (SceModule2*) sceKernelFindModuleByName("sceNp9660_driver"); g_sceNp9660_driver_text_addr = pMod->text_addr; // 6.30: 0x00003C34 // 6.20: move to 0x00003BD8: jal InitForKernel_29DAA63F _sw(0x3C028000, g_sceNp9660_driver_text_addr + g_offs->InitForKernelCall); // jal InitForKernel_23458221 to lui $v0, 0x00008000 // 6.30: 0x00003C4C // 6.20: move to 0x00003BF0: jal sub_00000000 _sw(MAKE_CALL(sub_00000588), g_sceNp9660_driver_text_addr + g_offs->Func1); // 6.30: 0x000043B4 // 6.20: move to 0x00004358: jal sub_00004388 _sw(MAKE_CALL(sub_00000054), g_sceNp9660_driver_text_addr + g_offs->Func2); // jal sub_3948 to jal sub_00000054 // 6.30: 0x0000590C // 6.20: move to 0x0000582C: jal sub_00004388 _sw(MAKE_CALL(sub_00000054), g_sceNp9660_driver_text_addr + g_offs->Func3); // jal sub_3948 to jal sub_00000054 // 6.30: 0x00007D08 // 6.20: move to 0x00007C28 _sw(MAKE_JUMP(sub_00000514), g_sceNp9660_driver_text_addr + g_offs->sceIoClose); // hook sceIoClose import // 6.30: 0x00003680 // 6.20: move to 0x00003624 g_func_1200 = pMod->text_addr + g_offs->Func4; printk("g_func_1200 0x%08X\n", (uint)g_func_1200); // sub_2f30 // 6.30: 0x00004F8C // 6.20: move to 0x00004EAC g_func_1208 = pMod->text_addr + g_offs->Func5; printk("g_func_1208 0x%08X\n", (uint)g_func_1208); // sub_4494 // 6.30: 0x00004FFC // 6.20: move to 0x00004F1C g_func_121C = pMod->text_addr + g_offs->Func6; printk("g_func_121C 0x%08X\n", (uint)g_func_121C); // sub_44ec clear_cache(); } return sceKernelStartThread(thid, arglen, argp); }
int startUsbHost() { tSceModule * pMod = ( tSceModule * )sceKernelFindModuleByName( "USBHostFS" ); if ( !pMod ) { if ( loadStartModule( USBHOSTFS_PRX, 0, NULL ) < 0 ) { log( "Error starting usbhostfs.prx\n" ); return -1; } } int ret; if ( fw_version < FW_500 || sceKernelInitKeyConfig() == PSP_INIT_KEYCONFIG_GAME ) { ret = sceUsbStart( PSP_USBBUS_DRIVERNAME, 0, 0 ); if ( ret != 0 ) { log( "Error starting USB Bus driver (0x%08X)\n", ret ); return -1; } } else { ret = sceUsbStart( PSP_USBBUS_DRIVERNAME, 0, 0 ); if ( ret != 0 ) { log( "Error starting USB Bus driver (0x%08X)\n", ret ); return -1; } } ret = sceUsbStart( HOSTFSDRIVER_NAME, 0, 0 ); if ( ret != 0 ) { log( "Error starting USB Host driver (0x%08X)\n", ret ); return -1; } ret = sceUsbActivate( HOSTFSDRIVER_PID ); sceKernelDelayThread( 2000000 ); return ret; }
static void patch_scePops_Manager(void) { SceModule2 *mod; u32 text_addr; size_t i; mod = (SceModule2*) sceKernelFindModuleByName("scePops_Manager"); text_addr = mod->text_addr; for(i=0; i<NELEMS(g_io_hooks); ++i) { hook_import_bynid((SceModule*)mod, "IoFileMgrForKernel", g_io_hooks[i].nid, g_io_hooks[i].fp, 0); } if(g_offs->popsman_patch.get_rif_path != 0xDEADBEEF) { _get_rif_path = (void*)(text_addr + g_offs->popsman_patch.get_rif_path); _sw(MAKE_CALL(&get_rif_path), text_addr + g_offs->popsman_patch.get_rif_path_call1); _sw(MAKE_CALL(&get_rif_path), text_addr + g_offs->popsman_patch.get_rif_path_call2); } sceNpDrmGetVersionKey = (void*)sctrlHENFindFunction("scePspNpDrm_Driver", "scePspNpDrm_driver", 0x0F9547E6); scePspNpDrm_driver_9A34AC9F = (void*)sctrlHENFindFunction("scePspNpDrm_Driver", "scePspNpDrm_driver", 0x9A34AC9F); if(g_offs->popsman_patch.sceNpDrmGetVersionKeyCall != 0xDEADBEEF) { _sw(MAKE_CALL(_sceNpDrmGetVersionKey), text_addr + g_offs->popsman_patch.sceNpDrmGetVersionKeyCall); } if(g_offs->popsman_patch.scePspNpDrm_driver_9A34AC9F_Call != 0xDEADBEEF) { _sw(MAKE_CALL(_scePspNpDrm_driver_9A34AC9F), text_addr + g_offs->popsman_patch.scePspNpDrm_driver_9A34AC9F_Call); } // remove the check in scePopsManLoadModule that only allows loading module below the FW 3.XX if(g_offs->popsman_patch.scePopsManLoadModuleCheck != 0xDEADBEEF) { _sw(NOP, text_addr + g_offs->popsman_patch.scePopsManLoadModuleCheck); } if (g_is_custom_ps1) { for(i=0; i<NELEMS(g_amctrl_hooks); ++i) { hook_import_bynid((SceModule*)mod, "sceAmctrl_driver", g_amctrl_hooks[i].nid, g_amctrl_hooks[i].fp, 0); } } }
/* New FindProc based on tyranid's psplink code. PspPet one doesn't work well with 2.7X+ sysmem.prx */ u32 FindProc(const char* szMod, const char* szLib, u32 nid) { struct SceLibraryEntryTable *entry; void *entTab; int entLen; SceModule * pMod = ( SceModule * )sceKernelFindModuleByName(szMod); if (!pMod) return 0; int i = 0; entTab = pMod->ent_top; entLen = pMod->ent_size; while(i < entLen) { int count; int total; unsigned int *vars; entry = (struct SceLibraryEntryTable *) (entTab + i); if(entry->libname && !strcmp(entry->libname, szLib)) { total = entry->stubcount + entry->vstubcount; vars = entry->entrytable; if(entry->stubcount > 0) { for(count = 0; count < entry->stubcount; count++) { if (vars[count] == nid) return vars[count+total]; } } } i += (entry->len * 4); } return 0; }
unsigned int * findExport( const char * szMod, const char * szLib, unsigned int nid ) { SceLibraryEntryTable *entry; tSceModule *pMod; void *entTab; int entLen; pMod = ( tSceModule * )sceKernelFindModuleByName( szMod ); if ( !pMod ) { return 0; } int i = 0; entTab = pMod->ent_top; entLen = pMod->ent_size; while( i < entLen ) { int count; int total; unsigned int *vars; entry = ( SceLibraryEntryTable * )( entTab + i ); if( entry->libname && ( !szLib || !strcmp( entry->libname, szLib ) ) ) { total = entry->stubcount + entry->vstubcount; vars = entry->entrytable; for( count = 0; count < entry->stubcount; count ++ ) { if ( vars[count] == nid ) { return &vars[count+total]; } } } i += ( entry->len * 4 ); } return NULL; }
void * patchLoadExecVSHCommon( void * func ) { tSceModule * pMod = ( tSceModule * )sceKernelFindModuleByName( "sceLoadExec" ); if ( fw_version == FW_371 ) LoadExecVSHCommon_ori[0].addr = pMod->text_addr + 0x0000121c; //same in standare/slim else if ( fw_version == FW_380 || fw_version == FW_390 ) LoadExecVSHCommon_ori[0].addr = pMod->text_addr + 0x000014cc; //same in standare/slim else if ( fw_version == FW_401 ) LoadExecVSHCommon_ori[0].addr = pMod->text_addr + 0x00001E1C; //same in standare/slim else if ( fw_version == FW_500 ) LoadExecVSHCommon_ori[0].addr = pMod->text_addr + 0x00001E58; //verified in phat else if ( fw_version == FW_550 ) LoadExecVSHCommon_ori[0].addr = pMod->text_addr + 0x00001F3C; //same on slim & phat LoadExecVSHCommon_ori[1].addr = LoadExecVSHCommon_ori[0].addr + 4; LoadExecVSHCommon_ori[0].val = _lw( LoadExecVSHCommon_ori[0].addr ); LoadExecVSHCommon_ori[1].val = _lw( LoadExecVSHCommon_ori[1].addr ); MAKE_JUMP( LoadExecVSHCommon_ori[0].addr, func ); _sw( NOP, LoadExecVSHCommon_ori[1].addr ); sceKernelIcacheInvalidateAll(); sceKernelDcacheWritebackInvalidateAll(); return ( void * )LoadExecVSHCommon_ori[0].addr; }
int myNpDrmRenameCheck(char *fn) { int ret; // don't worry, it works without setting $k1 to 0 if (sceKernelFindModuleByName("scePspNpDrm_Driver") == NULL) { ret = 0x8002013A; goto exit; } if(!check_memory(fn, strlen(fn) + 1)) { ret = 0x80550910; goto exit; } ret = check_file_is_encrypted_by_path(fn); if (ret == 0) { SceIoStat stat; u32 k1; k1 = pspSdkSetK1(0); ret = sceIoGetstat(fn, &stat) == 0 ? 0 : 0x80550901; pspSdkSetK1(k1); } else { if (_sceNpDrmRenameCheck != NULL) { ret = (*_sceNpDrmRenameCheck)(fn); } else { ret = 0x8002013A; } } exit: printk("%s: %s -> 0x%08X\n", __func__, fn, ret); return ret; }
int myNpDrmEdataSetupKey(SceUID fd) { int ret; if (sceKernelFindModuleByName("scePspNpDrm_Driver") == NULL) { ret = 0x8002013A; goto exit; } if (is_nodrm_fd(fd)) { ret = 0; } else { if (_sceNpDrmEdataSetupKey != NULL) { ret = (*_sceNpDrmEdataSetupKey)(fd); } else { ret = 0x8002013A; } } exit: printk("%s: 0x%08X -> 0x%08X\n", __func__, fd, ret); return ret; }
int vpbp_dread(SceUID fd, SceIoDirent * dir) { int result, cur_idx, ret; struct IoDirentEntry *entry; lock(); entry = dirent_search(fd); if(entry == NULL) { result = -44; goto exit; } result = sceIoDread(entry->iso_dfd, dir); if(sceKernelFindModuleByName("Game_Categories_Light") == NULL) { while(result > 0 && !is_iso(dir)) { result = sceIoDread(entry->iso_dfd, dir); } } if (result > 0 && is_iso(dir)) { VirtualPBP *vpbp; vpbp = vpbp_realloc(g_vpbps, g_vpbps_cnt+1); if(vpbp == NULL) { result = -42; goto exit; } g_vpbps = vpbp; g_vpbps_cnt++; cur_idx = g_vpbps_cnt-1; vpbp = &g_vpbps[cur_idx]; STRCPY_S(vpbp->name, entry->path); vpbp->name[4] = '\0'; STRCAT_S(vpbp->name, "/ISO"); STRCAT_S(vpbp->name, entry->path + sizeof("xxx:/PSP/GAME") - 1); STRCAT_S(vpbp->name, "/"); STRCAT_S(vpbp->name, dir->d_name); memcpy(&vpbp->ctime, &dir->d_stat.st_ctime, sizeof(vpbp->ctime)); memcpy(&vpbp->mtime, &dir->d_stat.st_mtime, sizeof(vpbp->mtime)); ret = get_cache(vpbp->name, &vpbp->mtime, vpbp); if (ret < 0) { ret = build_vpbp(vpbp); if (ret < 0) { result = -43; goto exit; } } result = add_fake_dirent(dir, cur_idx); } exit: unlock(); return result; }
// 0x00000340 int module_start(SceSize args, void* argp) { SceModule2 *pMod; int fd, key_config; SEConfig config; psp_model = sceKernelGetModel(); psp_fw_version = sceKernelDevkitVersion(); setup_patch_offset_table(psp_fw_version); printk_init("ms0:/LOG_GALAXY.TXT"); printk("PROGalaxyController started: 0x%08X\n", (uint)psp_fw_version); key_config = sceKernelApplicationType(); sctrlSEGetConfig(&config); if(config.iso_cache && psp_model != PSP_1000 && key_config == PSP_INIT_KEYCONFIG_GAME) { int bufsize; bufsize = config.iso_cache_total_size * 1024 * 1024 / config.iso_cache_num; if((bufsize % 512) != 0) { bufsize &= ~(512-1); } if(bufsize == 0) { bufsize = 512; } infernoCacheSetPolicy(config.iso_cache_policy); infernoCacheInit(bufsize, config.iso_cache_num); } g_iso_fn = sctrlSEGetUmdFile(); pMod = (SceModule2*)sceKernelFindModuleByName("sceThreadManager"); if(pMod != NULL) { // sceKernelCreateThread export _sw((u32)&myKernelCreateThread, pMod->text_addr + g_offs->sceKernelCreateThread); // sceKernelStartThread export _sw((u32)&myKernelStartThread, pMod->text_addr + g_offs->sceKernelStartThread); } else { printk("sceThreadManager cannot be found?!\n"); } clear_cache(); while( 1 ) { fd = sceIoOpen(g_iso_fn, PSP_O_RDONLY, 0); if(fd >= 0) { break; } sceKernelDelayThread(10000); } sceIoClose(fd); printk("%s: finished\n", __func__); return 0; }
int module_start(SceSize args, void *argp) { mod = sceKernelFindModuleByName("sceMeCodecWrapper"); return 0; }