示例#1
0
文件: main.c 项目: Joonie86/COBRA-7.3
void main(void)
{
	for (int i = 0; i < 128; i++)
	{
		uint64_t pte0 = *(uint64_t *)(MKA(0xf000000 | (i<<7)));
		uint64_t pte1 = *(uint64_t *)(MKA(0xf000000 | ((i<<7)+8)));
		
		lv1_write_htab_entry(0, i << 3, pte0, (pte1 & 0xff0000) | 0x190);
	}
}
示例#2
0
process_t get_vsh_process(void)
{
	uint64_t *proc_list = *(uint64_t **)MKA(TOC+process_rtoc_entry_1);	
	proc_list = *(uint64_t **)proc_list;
	proc_list = *(uint64_t **)proc_list;	
	for (int i = 0; i < 16; i++)
	{
		process_t p = (process_t)proc_list[1];	
		proc_list += 2;		
		if ((((uint64_t)p) & 0xFFFFFFFF00000000ULL) != MKA(0)) continue;
		if (is_vsh_process(p)) return p;
	}
	return 0;
}
示例#3
0
文件: main.c 项目: Joonie86/COBRA-7.3
int inst_and_run_kernel_dynamic(uint8_t *payload, int size, uint64_t *residence)
{
	if(!size)
		return -1;
	
	if(!payload)
		return -2;
	
	void *skprx=alloc(size, 0x27);
	if(skprx)
	{
		memcpy(skprx, get_secure_user_ptr(payload), size);

		f_desc_t f;
		int (* func)(void);
		f.addr = skprx;
		f.toc = (void *)MKA(TOC);
		func = (void *)&f;
		func();
		uint64_t resident=(uint64_t)skprx;
		copy_to_user(&resident, get_secure_user_ptr(residence), 8);
		return 1;
	}
	
	return 0;
}
示例#4
0
int main(void)
{
	u8 *payload, *stage2;
	int payload_size, result;
		
#ifdef DEBUG
	debug_init();	
#endif

	DPRINTF("Stage 1.5 lan hello.\n");	
	
	result = gelic_init();
	if (result != 0)
		goto error;
	
	payload = (void *)MKA(0x700000);//alloc(MAX_PAYLOAD_SIZE, 0x27);
	if (!payload)
		goto error;
	
	payload_size = gelic_recv_data(payload, MAX_PAYLOAD_SIZE);
	if (payload_size <= 0)
		goto error;	
		
	DPRINTF("Receive data: %d\n", payload_size);
	
	stage2 = alloc(payload_size, 0x27);
	if (!stage2)
		goto error;
	
	memcpy(stage2, payload, payload_size);
	clear_icache(stage2, payload_size);
	memset(payload, 0, payload_size);
	
	//dealloc(payload, 0x27);

	result = gelic_deinit();
	if (result != 0)
		goto error;

	/*result = mm_deinit();
	if (result != 0)
		goto error;*/

	f_desc_t desc;	
	desc.addr = stage2;
	
	DPRINTF("Calling stage2...\n");
	debug_end();
	void (* stage2_func)(void) = (void *)&desc;
	stage2_func();	
	
	return 0;

error:

	lv1_panic(0);
	return -1;
}
示例#5
0
文件: main.c 项目: Joonie86/COBRA-7.3
int inst_and_run_kernel(uint8_t *payload, int size)
{
	if((!size) || (size>0x10000))
		return -1;
	
	if(!payload)
		return -2;
	
	memcpy((void *)0x80000000007f0000, get_secure_user_ptr(payload), size);

	f_desc_t f;
	int (* func)(void);
	f.addr = (void *)0x80000000007f0000;
	f.toc = (void *)MKA(TOC);
	func = (void *)&f;
	func();
	return 0;
}
示例#6
0
int sys_load_mamba(char *mamba_file)
{
	if (mamba_loaded == 1) return ECANCELED;
	mamba_file = get_secure_user_ptr(mamba_file); 
	CellFsStat stat;
	int ret = cellFsStat(mamba_file, &stat);
	if (ret == 0)
	{
		int fd;	
		ret = cellFsOpen(mamba_file, CELL_FS_O_RDONLY, &fd, 0, NULL, 0);
		if (ret == 0)
		{
			uint32_t psize = stat.st_size;	
			void *mamba = alloc(psize, 0x27);
			if (mamba)
			{
				uint64_t rs;
				ret = cellFsRead(fd, mamba, psize, &rs);
				cellFsClose(fd);
				if (ret != 0)
				{
					dealloc(mamba, 0x27);
					mamba = NULL;
					return ret;
				}
				mamba_loaded = 1;	
				f_desc_t f;
				f.toc = (void *)MKA(TOC);
				int (* func)(void);	
				f.addr = mamba;			
				func = (void *)&f;	
				func();
				return 0;
			}
			return ENOMEM;
		}       
	}
	return ret;
}
示例#7
0
int main(void)
{
	void *stage2 = NULL;
	
	f_desc_t f;
	int (* func)(void);	
	int ret;
	
#ifdef DEBUG		
	debug_init();
	DPRINTF("Stage 1 hello.\n");	
#endif
	f.addr = flash_mount_clone;
	f.toc = (void *)MKA(TOC);
	func = (void *)&f;
	
	ret = func();
	
	if (ret != 0 && ret != 1)
	{
		DPRINTF("Flash mount failed!\n");		
	}
	else
	{
		CellFsStat stat;
		
		DPRINTF("Flash mounted\n");
				
		if (cellFsStat(STAGE2_FILE, &stat) == 0)
		{
			int fd;
			
			if (cellFsOpen(STAGE2_FILE, CELL_FS_O_RDONLY, &fd, 0, NULL, 0) == 0)
			{
				uint32_t psize = stat.st_size;
				
				DPRINTF("Payload size = %d\n", psize);
				
				stage2 = alloc(psize, 0x27);
				if (stage2)
				{
					uint64_t rs;
					
					if (cellFsRead(fd, stage2, psize, &rs) != 0)
					{
						DPRINTF("Stage 2 read fail.\n");
						dealloc(stage2, 0x27);
						stage2 = NULL;
					}
				}
				else
				{
					DPRINTF("Cannot allocate stage2\n");
				}
				
				cellFsClose(fd);
			}
		}
		else
		{
			DPRINTF("There is no stage 2, booting system.\n");
		}
	}
	
	if (stage2)
	{
		f.addr = stage2;			
		func = (void *)&f;	
		DPRINTF("Calling stage 2...\n");
		func();
	}
	
	return ret;
}