forked from LightningMods/PPPwn
-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add
permanent_uart
. (LightningMods#9)
- Loading branch information
Showing
2 changed files
with
136 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,37 @@ | ||
LIBPS4 := $(PS4SDK)/libPS4 | ||
|
||
CC := gcc | ||
OBJCOPY := objcopy | ||
ODIR := build | ||
SDIR := source | ||
IDIRS := -I$(LIBPS4)/include -Iinclude | ||
LDIRS := -L$(LIBPS4) | ||
MAPFILE := $(shell basename "$(CURDIR)").map | ||
CFLAGS := $(IDIRS) -Os -std=c11 -ffunction-sections -fdata-sections -fno-builtin -nostartfiles -nostdlib -Wall -Wextra -masm=intel -march=btver2 -mtune=btver2 -m64 -mabi=sysv -mcmodel=small -fpie -fPIC | ||
LFLAGS := $(LDIRS) -Xlinker -T $(LIBPS4)/linker.x -Xlinker -Map="$(MAPFILE)" -Wl,--build-id=none -Wl,--gc-sections | ||
CFILES := $(wildcard $(SDIR)/*.c) | ||
SFILES := $(wildcard $(SDIR)/*.s) | ||
OBJS := $(patsubst $(SDIR)/%.c, $(ODIR)/%.o, $(CFILES)) $(patsubst $(SDIR)/%.s, $(ODIR)/%.o, $(SFILES)) | ||
|
||
LIBS := -lPS4 | ||
|
||
TARGET = $(shell basename "$(CURDIR)").bin | ||
|
||
$(TARGET): $(ODIR) $(OBJS) | ||
$(CC) $(LIBPS4)/crt0.s $(ODIR)/*.o -o temp.t $(CFLAGS) $(LFLAGS) $(LIBS) | ||
$(OBJCOPY) -O binary temp.t "$(TARGET)" | ||
rm -f temp.t | ||
|
||
$(ODIR)/%.o: $(SDIR)/%.c | ||
$(CC) -c -o $@ $< $(CFLAGS) | ||
|
||
$(ODIR)/%.o: $(SDIR)/%.s | ||
$(CC) -c -o $@ $< $(CFLAGS) | ||
|
||
$(ODIR): | ||
@mkdir $@ | ||
|
||
.PHONY: clean | ||
|
||
clean: | ||
rm -rf "$(TARGET)" "$(MAPFILE)" $(ODIR) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,99 @@ | ||
#include <ps4.h> | ||
|
||
// #define DEBUG_SOCKET | ||
// #define DEBUG_IP "192.168.1.200" | ||
// #define DEBUG_PORT 9023 | ||
|
||
static int (*sceKernelDebugOutText)(int, | ||
const char *) = NULL; | ||
// size_t page_size = 0x4000; | ||
|
||
void *kernel_base = NULL; | ||
uint16_t fw_version = -1; | ||
|
||
#define icc_nvs_write_macro_alt(x) \ | ||
icc_nvs_write = (void *)(kernel_base + K##x##_ICC_NVS_WRITE); | ||
|
||
int kpayload_perm_uart_alt() { | ||
uint64_t (*icc_nvs_write)(uint32_t block, uint32_t offset, uint32_t size, void *value); | ||
|
||
// NOTE: This is a C preprocessor macro | ||
build_kpayload(fw_version, icc_nvs_write_macro_alt); | ||
|
||
char uart = 1; | ||
icc_nvs_write(4, 0x31F, 1, &uart); | ||
|
||
return 0; | ||
} | ||
|
||
int kpayload(struct thread *td) { | ||
kernel_base = &((uint8_t *)__readmsr(0xC0000082))[-0x1C0]; | ||
|
||
struct ucred *cred = td->td_proc->p_ucred; | ||
cred->cr_uid = 0; | ||
cred->cr_ruid = 0; | ||
cred->cr_rgid = 0; | ||
cred->cr_groups[0] = 0; | ||
|
||
// escalate ucred privs, needed for access to the filesystem ie* mounting & decrypting files | ||
void *td_ucred = *(void **)(((char *)td) + 304); // p_ucred == td_ucred | ||
|
||
// sceSblACMgrIsSystemUcred | ||
uint64_t *sonyCred = (uint64_t *)(((char *)td_ucred) + 96); | ||
*sonyCred = 0xffffffffffffffff; | ||
|
||
// sceSblACMgrGetDeviceAccessType | ||
uint64_t *sceProcType = (uint64_t *)(((char *)td_ucred) + 88); | ||
*sceProcType = 0x3801000000000013; // Max access | ||
|
||
// sceSblACMgrHasSceProcessCapability | ||
uint64_t *sceProcCap = (uint64_t *)(((char *)td_ucred) + 104); | ||
*sceProcCap = 0xffffffffffffffff; // Sce Process | ||
|
||
return 0; | ||
} | ||
|
||
int _main(struct thread *td) { | ||
UNUSED(td); | ||
|
||
// Initialize PS4 Kernel, libc, and networking | ||
initKernel(); | ||
initLibc(); | ||
initSysUtil(); | ||
|
||
// Load and resolve libkernel_sys library | ||
int libk = sceKernelLoadStartModule("libkernel_sys.sprx", 0, NULL, 0, 0, 0); | ||
RESOLVE(libk, sceKernelDebugOutText); | ||
|
||
sceKernelSleep(1); | ||
|
||
// Output initialization messages | ||
if (sceKernelDebugOutText) { | ||
sceKernelDebugOutText(0, "==========================\n"); | ||
sceKernelDebugOutText(0, "Hello From inside Shellcore!!!\n"); | ||
sceKernelDebugOutText(0, "==========================\n"); | ||
} | ||
|
||
#ifdef DEBUG_SOCKET | ||
initNetwork(); | ||
DEBUG_SOCK = SckConnect(DEBUG_IP, DEBUG_PORT); | ||
#endif | ||
|
||
// jailbreak(); | ||
syscall(11, &kpayload, NULL); | ||
|
||
// sceKernelDebugOutText(0, "called enable_perm_uart()\n"); | ||
// enable_perm_uart(); | ||
|
||
fw_version = get_firmware(); | ||
syscall(11, &kpayload_perm_uart_alt, NULL); | ||
|
||
printf_notification("Enabled UART!"); | ||
|
||
#ifdef DEBUG_SOCKET | ||
printf_debug("Closing socket...\n"); | ||
SckClose(DEBUG_SOCK); | ||
#endif | ||
|
||
return 0; | ||
} |