Editing PS3 Payload Development

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
[[Category:Software]]
'''marked for cleanup'''
== Payload benefits (peek/poke advantages in general) ==
== Payload benefits (peek/poke advantages in general) ==
To make changes to system, without the need (and risk) for hardpatching while making on-demand/live patches possible.
To make changes to system, without the need (and risk) for hardpatching while making on-demand/live patches possible.
Line 8: Line 11:


== PPU/SPU Assembler ==
== PPU/SPU Assembler ==
It's true, almost no one need assembler anymore but for reversing we need it, because we need to understand what the CPU does. In alot cases we just have a dump to extract this information. I use the PL3 lv2_dump_analyser.idc script to reverse my lv2 dump with IDA.
It's true, almost no one need assembler anymore but for reversing we need it, because we need to understand what the CPU does. In alot cases we just have an dump to extract this information. I use the PL3 lv2_dump_analyser.idc script to reverse my lv2 dump with IDA.


=== Resources ===
=== Resources ===
Line 200: Line 203:


=== Understanding the Hack ===
=== Understanding the Hack ===
(section never written)
=== Patching ===
=== Patching ===
(section never written)
=== Hooking a function (strncmp) ===
=== Hooking a function (strncmp) ===
I try to explain how to do it with the PL3. PL3 loads a patch_table (see below). This patches are applied to the memory.  
I try to explain how to do it with the PL3. PL3 loads a patch_table (see below). This patches are applied to the memory.  
Line 312: Line 311:
Now our strncmp gets hooked and our function will get called and we jump back to the strncmp.  
Now our strncmp gets hooked and our function will get called and we jump back to the strncmp.  


Why this won't work that easy and why we jump to "strncmp+4" will be more clear in "Recreate overwritten code".
Why this won't work that easy and why we jump to "strncmp+4" will be more clear in "Recreate overwritten code".  


=== Recreate overwritten code ===
=== Recreate overwritten code ===
Line 407: Line 406:
#endif
#endif
</pre>
</pre>
That we jump to "strncmp+4" should be clear now, we have to "overjump" our branch to hook_strncmp.
That we jump to "strncmp+4" should be clear now, we have to "overjump" our branch to hook_strncmp.  


=== Saving the Register ===
=== Saving the Register ===
Line 492: Line 491:


=== Modify a function  ===
=== Modify a function  ===
(section never written)
=== Doing our own crap  ===
=== Doing our own crap  ===
(section never written)
=== Debug via ETH  ===
=== Debug via ETH  ===
Using payloader3 in combination with [https://github.com/AerialX/Kammy kammy] you are able to receive debug via udp over ethernet.
Using payloader3 in combination with [https://github.com/AerialX/Kammy kammy] you are able to receive debug via udp over ethernet.
Line 513: Line 508:


=== Creating a Syscall (explained on Peek & Poke)  ===
=== Creating a Syscall (explained on Peek & Poke)  ===
(section never written)
 


=== Compiling PL3 (debian/Ubuntu 10.10) ===
=== Compiling PL3 (debian/Ubuntu 10.10) ===
Line 545: Line 540:
First thing we need to do is install some applications through apt, so open a terminal and do the following:
First thing we need to do is install some applications through apt, so open a terminal and do the following:


{{keyboard|content=<syntaxhighlight lang="bash">
{{keyboard|content=
sudo apt-get install git-core gnupg flex bison gperf libsdl1.2-dev libesd0-dev libwxgtk2.6-dev \
sudo apt-get install git-core gnupg flex bison gperf libsdl1.2-dev libesd0-dev libwxgtk2.6-dev \
build-essential zip curl libncurses5-dev zlib1g-dev gcc-4.3 cpp-4.3 g++-4.3 texinfo autoconf
build-essential zip curl libncurses5-dev zlib1g-dev gcc-4.3 cpp-4.3 g++-4.3 texinfo autoconf
</syntaxhighlight>}}
}}


Now we need to clone PSFreedom from github to our local PC, pull it's submodules and get the toolchain installed
Now we need to clone PSFreedom from github to our local PC, pull it's submodules and get the toolchain installed


{{keyboard|content=<syntaxhighlight lang="bash">
{{keyboard|content=
cd ~/
cd ~/
git clone git://github.com/kakaroto/PSFreedom.git
git clone git://github.com/kakaroto/PSFreedom.git
Line 561: Line 556:
cd ps3toolchain
cd ps3toolchain
sudo ./toolchain-sudo.sh
sudo ./toolchain-sudo.sh
</syntaxhighlight>}}
}}


Now go get a Coffee/sleep, installing the toolchain can take a few hours (6-7 hours if you are running Ubuntu in a Virtual PC)
Now go get a Coffee/sleep, installing the toolchain can take a few hours (6-7 hours if you are running Ubuntu in a Virtual PC)
Line 569: Line 564:
Now you need to edit your .bashrc file:
Now you need to edit your .bashrc file:


{{keyboard|content=<syntaxhighlight lang="bash">gedit ~/.bashrc</syntaxhighlight>}}
{{keyboard|content=
gedit ~/.bashrc
}}


Add the following line to the end of the file:
Add the following line to the end of the file:


{{keyboard|content=<syntaxhighlight lang="bash">export PATH=${PATH}:/usr/local/ps3dev/ppu/bin/</syntaxhighlight>}}
{{keyboard|content=
export PATH=${PATH}:/usr/local/ps3dev/ppu/bin/
}}


To compile PSFreedom's payloads is simple now, open a terminal and do the following:
To compile PSFreedom's payloads is simple now, open a terminal and do the following:


{{keyboard|content=<syntaxhighlight lang="bash">
{{keyboard|content=
cd ~/PSFreedom/pl3
cd ~/PSFreedom/pl3
make
make
</syntaxhighlight>}}
}}


That's it, you can now find the payload .bin files in the PSFreedom/pl3 folder.
That's it, you can now find the payload .bin files in the PSFreedom/pl3 folder.  


== Other ==
== Other ==
Line 590: Line 589:


''Palmam qui meruit ferat''
''Palmam qui meruit ferat''
{{Development}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)