ps4dev/ps4sdk

Modular open source ps4 sdk with user and kernel space support

ps4sdk's Issues

CXX std support

I've managed to build LibC++ and link it against the libcinternal using the CXX branch, had few things such as std string/array/atomic working(they probably dont even need the library itself (?) ). but it failed to link when using std::threads due to undefined __dso_handle.

so I've few questions.
would the sdk resolve symbols ptr that are not functions, as is the case above?
if so would that work the same as functions, aka $(eval $(call generateModule, libScePsm, __dso_handle)).
lastly according to this that symbol is in libScePsm.sprx could you confirm that? I would have guessed this would be in Libc or libCInternal :/

edit:
as per this post while not linking to shared libraries it's safe to define __dso_handle manually, so would that be true in our case or would the stub be considered shared libraries, atlas would they be in the case of __dso_handle :/

P.S Zer0xFF

Fix thread struct offsets and other reported issues

hitodama/libps4#6
hitodama/libps4#5

Kernel malloc RWX

I tried a while back using several different abstractions (malloc, vm_*, pmap ...) but I couldn't get rwx to stick. I could imagine it's a check ...

• Either find a way
  • Retry
  • If failes, investigate for checks
• Or disable the whole protection by default

Elf loader port and lib

Needs to be done, should be stand alone for cleanness and minimalism of the sdk.

LLVM disassembler in kernel

The disassembler sadly does not work in kernel space. It is needed for a clean hooking mechanism.

Binary release

• Release binary as part of version v0.1.0
• Maybe set up CI

Last minute renaming

Maybe rename core to sce and common to ps4 (or core)

This does not work.

Fix it.

Improve make targets

• Include ps targets to build to kernel only, user only and mixed
• Include clean process and rop targets
• Sensible defaults: Make sure that Make system is dynamic and easy to use for all projects, without including unwanted things (exploit should be linked into mixed mode as long as we have one primary one -> provide extra variables to override)

Clean up

Before release check all headers for

• Includes
• Signatures
• Unused stuff

There is not enough free system memory

The new elf-loader just keeps crashing on me, at the final step of loading the loader, it just crashes and a web browser throws There is not enough free system memory.

Support ps4sh transition

• Antonio should be supported in his efforts to adapt the sdk
• Fork -> Pull request asap.

Missing header file "opt_compat.h"

include/machine/reg.h:41:10: fatal error:
'opt_compat.h' file not found

include "opt_compat.h"

Works fine once you add an empty header (opt_compat.h) in the include dir. Error occurs when you include sys/ptrace.h in a kernel 'module' (kmain.c).

rela rodata in binary builds

The compiler puts static consts and multi-dimensional arrays into a special section - which the current (simple) setup of locating text and data to a specific address is not able to handle well (size shoots up due to assigned address).

So far I simply avoided such constructs.

Unsupported type using make_fself

I'm trying to code an homebrew for PS4 and I have succesfully set and compiled an example. But when I try to "fake sign" with make_fself by flatz I have this message: "error: unable to load elf file: ('Unsupported type.')

How can I fix this?

Thanks for all your work!

README and documentation

It's needed, do it.

• Naming convention (Sony based)
• Dependency diagram and modular description
  • Hacking & improvement guide
• Contribution guide
• Needed, next steps, todos and wiki
• Document code (even if minimally)
• Document further knowledge in wiki / start wiki

ps4KernelCall magic breaks

The (cool) macro logic seems to break the linker somehow. If you have not used ps4KernelExecute anywhere, it does not know that the lib should be included. Need to see if we need to change the function or can fix the pre-processor. ... Ah the pre-processor ...

Hooking

• Hook arbitrary kernel functions and syscalls transparently and interrupt-able.
• Support an arbitrary amount of hooks.
• Don't bother with userland hooking (can be done writing a resolver)

Next steps

Base infrastructure

• Minimal stand-alone kernel-only lib
• Cleanup libps4 (breaking changes), separate user and kernel calls, restructure headers a bit (=> ended up being a modular re-write ^^')
  • Mix and match approach (use and link-in what you need from kernel only to sce libc + pad to magically mixed kernel-user-space-shifting-privledge-escalating builds)
• Optimize for static build (multiple translation units) - no hurry
• Re-purpose hooks function to a man-in-the-middle interface (observe
  calls and/or intercept)
• Rename current simple hooks to "patch to jump to" (or so)
• Make "run" interface dynamic (choose between main, syscall, ... signature)

Kernel

• Kernel proc example
• Kernel (proc) elf loader
• Remote peek, poke, seek and hook payload

Stability and progress

• Look into sceSbl is/has checks for a complete patch out payload
• Look into dlsym and sprx stuff to get symbols etc., find and read out

Further insights

• Ptrace process tool (?)
• Reverse structures, fix structs
• Look into update unpack and warm reboot (no real idea whats possible
  there atm)
• Look into local load via SQL / menu hack

The efforts above are code-named buster.

Cache ps4KernDlSym

As it used in the sdk to access variables and somewhat slow it should be improved by a cache or a second cached version (like ps4KernDlSymCached or ps4KernLookupSymbol).

• Use something small like uthash or so
• Make sure it runs in kernel ...

Syscall return

• Returning from syscalls seems fragile (only 0 and +errnos seem not to crash) => maybe check and limit return
• td_retval (the real return value) seems not to work proper (example crashes) investigate

no such file system_call_rop_standard.mk

in files ps4_elf_sce.mk ps4_elf_standard.mk

linker options changed from last commits

before changes loader from https://github.com/psxdev/ps4link/blob/ps4sdk_work/elfldr/ps4link/Makefile compile fine only i need to add SceNet_stub in Makefile :

clang /usr/local/ps4dev/ps4sdk/crt0.s build/commands.c.o build/debugnet.c.o build/elfloader.c.o build/main.c.o build/ps4link.c.o build/requests.c.o -O3 -Wall -m64 -L. -Llib -nostdlib -L/usr/local/ps4dev/ps4sdk/lib -Wl,-Ttext,0x93a300000 -Wl,-Tdata,0x93a400000 -lSceNet_stub -lPs4_extension_kernel_execute_dynlib_prepare_dlclose -lPs4_common_mixed -lPs4_common_kern -lPs4_common_user -lPs4LibCInternalMixed_stub -lPs4LibKernelMixed_stub -lSceLibcInternal_stub -lkernel_stub -lPs4Kern_stub -lPs4_base_stub_resolve_minimal -lPs4_base_kern_dlsym_standard -lPs4_base_kern_seek_elf_address_standard -lPs4_base_assembler_syscall_rop_0x93a4FFFF8 -lPs4_base_assembler_register_standard -o bin/ldr
objcopy bin/ldr -O binary bin/ldr

however with new changes default libraries are not added by default:
clang /usr/local/ps4dev/ps4sdk/crt0.s build/commands.c.o build/debugnet.c.o build/elfloader.c.o build/main.c.o build/ps4link.c.o build/requests.c.o -O3 -Wall -m64 -L. -Llib -nostdlib -L/usr/local/ps4dev/ps4sdk/lib -Wl,-Ttext,0x93a300000 -Wl,-Tdata,0x93a400000 -lSceNet_stub -o bin/ldr

execvp: ar: Argument list too long

There are too much files and if we use a large path when compiling we can get that fail
there are 10308 .o files in build/libPs4Kern
We need to fix that