Editing PS3 Payload Development
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
== | === Preface === | ||
=== Assembler is dead -.- === | |||
It's true, almost no one need assembler anymore but for reversing we need it, because we need to understand what the CPU does. In alot cases we just have an dump to extract this information. I use the PL3 lv2_dump_analyser.idc script to reverse my lv2 dump with IDA. | |||
== | === Resources === | ||
[http://publib.boulder.ibm.com/infocenter/aix/v6r1/index.jsp? IBM Instruction Set] | |||
[http://pds.twi.tudelft.nl/vakken/in101/labcourse/instruction-set/ Another Instruction Set] | |||
Thanks to [http://twitter.com/#!/KaKaRoToKS KaKaRoToKS] | |||
=== | === Why do we develope Payloads? === | ||
There are alot reasons. I give you some: | |||
*Want to have a better knowledge about the GameOS/Hypervisor | |||
*Want to play backups (Hermes Gamepad patch etc.) | |||
*Want to cheat or modify a game | |||
*Want to have fun | |||
*... | |||
=== PL3 === | |||
Structure of PL3 | |||
payload_dev.S Is the main "File", this includes everything and has the jailbreak in it (payload_main:) | payload_dev.S Is the main "File", this includes everything and has the jailbreak in it (payload_main:) | ||
Line 25: | Line 29: | ||
'''firmware_symbols.h.S''' Defines the most common firmware Symbols (ex. strncmp) | '''firmware_symbols.h.S''' Defines the most common firmware Symbols (ex. strncmp) | ||
'''map_open_path.h.S''' Base function for the Syscall 35 which is added. | '''map_open_path.h.S''' Base function for the Syscall 35 which is added. (dunno much about it at the moment) | ||
'''memory_patching.h.S''' | '''memory_patching.h.S''' dunno at the moment | ||
'''send_eth.h.S''' Function used to init the eth device. | '''send_eth.h.S''' Function used to init the eth device. | ||
Line 33: | Line 37: | ||
'''send_eth_res.h.S''' Function for sending data via eth. (Protocol is 0x1337) | '''send_eth_res.h.S''' Function for sending data via eth. (Protocol is 0x1337) | ||
'''memory_patching_res.h.S''' | '''memory_patching_res.h.S''' dunno at the moment | ||
'''dev_syscalls.h.S''' Peek and Poke functions | '''dev_syscalls.h.S''' Peek and Poke functions | ||
Line 58: | Line 62: | ||
=== Handy Macros === | === Handy Macros === | ||
'''MEM_BASE2''' is defined in the '''firmware_symbols.h.S''' | '''MEM_BASE2''' is defined in the '''firmware_symbols.h.S''' | ||
<pre>#define ADDR_IN_PAGE(target) (PAYLOAD_OFFSET_IN_PAGE + (target) - payload_entry)</pre> | |||
'''ADDR_IN_PAGE''' | |||
<pre> | |||
#define ADDR_IN_PAGE(target) (PAYLOAD_OFFSET_IN_PAGE + (target) - payload_entry) | |||
</pre> | |||
'''ADDR_IN_MEM2''' calculates the adress relative to the RESIDENT_AREA_OFFSET (resident_area_start) | '''ADDR_IN_MEM2''' calculates the adress relative to the RESIDENT_AREA_OFFSET (resident_area_start) | ||
<pre>#define ADDR_IN_MEM2(target) ((target) - RESIDENT_AREA_OFFSET)</pre> | <pre>#define ADDR_IN_MEM2(target) ((target) - RESIDENT_AREA_OFFSET)</pre> | ||
'''ABSOLUTE_MEM2''' | '''ABSOLUTE_MEM2''' calculates the adress relative to the current position. So you can give your banches an absolute memory address and it calculates the branch address to it for you. | ||
calculates the adress relative to the current position. So you can give your banches an absolute memory address and it calculates the branch address to it for you. | |||
<pre>// Absolute branching | <pre>// Absolute branching | ||
Line 198: | Line 207: | ||
bl pl3_memcpy; \ | bl pl3_memcpy; \ | ||
</pre> | </pre> | ||
Source codes are from PL3 | |||
=== Understanding the Hack === | === Understanding the Hack === | ||
=== Patching === | === Patching === | ||
=== Hooking a function (strncmp) === | === Hooking a function (strncmp) === | ||
I try to explain how to do it with the PL3. PL3 loads a patch_table (see below). This patches are applied to the memory. | I try to explain how to do it with the PL3. PL3 loads a patch_table (see below). This patches are applied to the memory. | ||
Line 312: | Line 318: | ||
Now our strncmp gets hooked and our function will get called and we jump back to the strncmp. | Now our strncmp gets hooked and our function will get called and we jump back to the strncmp. | ||
Why this won't work that easy and why we jump to "strncmp+4" will be more clear in "Recreate overwritten code". | Why this won't work that easy and why we jump to "strncmp+4" will be more clear in "Recreate overwritten code". | ||
=== Recreate overwritten code === | === Recreate overwritten code === | ||
Line 407: | Line 413: | ||
#endif | #endif | ||
</pre> | </pre> | ||
That we jump to "strncmp+4" should be clear now, we have to "overjump" our branch to hook_strncmp. | That we jump to "strncmp+4" should be clear now, we have to "overjump" our branch to hook_strncmp. | ||
=== Saving the Register === | === Saving the Register === | ||
Line 492: | Line 498: | ||
=== Modify a function === | === Modify a function === | ||
=== Doing our own crap === | === Doing our own crap === | ||
=== Debug via ETH === | === Debug via ETH === | ||
=== Creating a Syscall (explained on Peek & Poke) === | === Creating a Syscall (explained on Peek & Poke) === | ||
=== What next? === | |||
=== | |||
Credit | |||
Tutorial written by [http://twitter.com/#!/KDSBest KDSBest's Twitter] | |||
'''Thanks to''' | |||
[http://twitter.com/#!/KaKaRoToKS KaKaRoToKS] | |||
[http://twitter.com/#!/Mathieulh Mathieulh] | |||
Hermes | |||
[http://twitter.com/#!/brandonlwilson brandonw] | |||
[https://twitter.com/#!/Irvysan Irv] | |||
[http://twitter.com/phirenz phirenz] | |||
Retrieved from "http://ps3wiki.lan.st/index.php/PS3_Payload_Developement" |