Add files via upload

Author: valentinbreiz

source/defines.h

@@ -149,6 +149,7 @@ struct ucred {
 struct proc {
 	char useless[64];
 	struct ucred *p_ucred;
+	struct filedesc *p_fd;
 };
 
 struct thread {
@@ -170,6 +171,20 @@ struct fileops {
 	int	fo_flags;	/* DFLAG_* below */
 };
 
+struct filedesc {
+	void *useless1[3];
+    	void *fd_rdir;
+    	void *fd_jdir;
+};
+
+struct kpayload_args{
+	uint64_t user_arg;
+};
+
+struct kdump_args{
+    	uint64_t argArrayPtr;
+};
+
 #define X86_CR0_WP (1 << 16)
 
 static inline __attribute__((always_inline)) uint64_t readCr0(void) {

source/main.c

@@ -3,31 +3,72 @@
 #include "ps4.h"
 #include "defines.h"
 
+#define    KERN_XFAST_SYSCALL 0x30EB30
+
+#define	CTL_KERN	1	/* "high kernel": proc, limits */
+#define	KERN_PROC	14	/* struct: process entries */
+#define	KERN_PROC_VMMAP	32	/* VM map entries for process */
+#define	KERN_PROC_PID	1	/* by process id */
+
 extern char kexec[];
 extern unsigned kexec_size;
 
 static int sock;
 
 void usbthing();
 
-int _main(void) {
+unsigned int long long __readmsr(unsigned long __register) {
+	// Loads the contents of a 64-bit model specific register (MSR) specified in
+	// the ECX register into registers EDX:EAX. The EDX register is loaded with
+	// the high-order 32 bits of the MSR and the EAX register is loaded with the
+	// low-order 32 bits. If less than 64 bits are implemented in the MSR being
+	// read, the values returned to EDX:EAX in unimplemented bit locations are
+	// undefined.
+	unsigned long __edx;
+	unsigned long __eax;
+	__asm__ ("rdmsr" : "=d"(__edx), "=a"(__eax) : "c"(__register));
+	return (((unsigned int long long)__edx) << 32) | (unsigned int long long)__eax;
+}
 
-	initKernel();	
-	initLibc();
-	initNetwork();
+int kpayload(struct thread *td, struct kpayload_args* args){
 
-	struct sockaddr_in server;
+	printfsocket("Starting kpayload...\n");
 
-	server.sin_len = sizeof(server);
-	server.sin_family = AF_INET;
-	server.sin_addr.s_addr = IP(192, 168, 1, 12);
-	server.sin_port = sceNetHtons(9023);
-	memset(server.sin_zero, 0, sizeof(server.sin_zero));
-	sock = sceNetSocket("debug", AF_INET, SOCK_STREAM, 0);
-	sceNetConnect(sock, (struct sockaddr *)&server, sizeof(server));
-	int flag = 1;
-	sceNetSetsockopt(sock, IPPROTO_TCP, TCP_NODELAY, (char *)&flag, sizeof(int));
+	struct ucred* cred;
+	struct filedesc* fd;
+
+	fd = td->td_proc->p_fd;
+	cred = td->td_proc->p_ucred;
+
+	printfsocket("Reading kernel_base...\n");
+	void* kernel_base = &((uint8_t*)__readmsr(0xC0000082))[-0x30EB30];
+	uint8_t* kernel_ptr = (uint8_t*)kernel_base;
+	void** got_prison0 =   (void**)&kernel_ptr[0xF26010];
+	void** got_rootvnode = (void**)&kernel_ptr[0x206D250];
+	
+	printfsocket("Resolve kernel functions...\n");
+
+	int (*copyout)(const void *kaddr, void *uaddr, size_t len) = (void *)(kernel_base + 0x286d70);
+	int (*printfkernel)(const char *fmt, ...) = (void *)(kernel_base + 0x347580);
+	int (*copyin)(const void *uaddr, void *kaddr, size_t len) = (void *)(kernel_base + 0x286df0);
+
+	cred->cr_uid = 0;
+	cred->cr_ruid = 0;
+	cred->cr_rgid = 0;
+	cred->cr_groups[0] = 0;
+
+	cred->cr_prison = *got_prison0;
+	fd->fd_rdir = fd->fd_jdir = *got_rootvnode;
+
+	printfsocket("Enabling uart...\n");
+	uint16_t *securityFlags = (uint64_t *)(kernel_base+0x2001516);
+	*securityFlags = *securityFlags & ~(1 << 15);	
 
+	printfsocket("Disabling write protection...\n");
+	uint64_t cr0 = readCr0();
+	writeCr0(cr0 & ~X86_CR0_WP);
+	
+	//Kexec
 	printfsocket("Kexec init...\n");
 
 	void *DT_HASH_SEGMENT = (void *)0xffffffff82200160;
@@ -36,7 +77,7 @@ int _main(void) {
 
 	printfsocket("Kexec size [%d]\n", kexec_size);
 
-	memcpy(DT_HASH_SEGMENT, kexec, kexec_size); //Fails here
+	copyin(DT_HASH_SEGMENT, kexec, kexec_size);
 
 	printfsocket("Kexec init [1]\n");
 
@@ -45,26 +86,76 @@ int _main(void) {
 	printfsocket("Kexec init [2]\n");
 
 	kexec_init(NULL, NULL);
+
+	printfsocket("Kexec inited successfully!\n");
+
+	// Say hello and put the kernel base in userland to we can use later
+
+	printfkernel("\n\n\nHELLO FROM YOUR KERN DUDE =)\n\n\n");
+
+	printfkernel("kernel base is:0x%016llx\n", kernel_base);
+
+	uint64_t uaddr;
+	memcpy(&uaddr,&args[2],8);
+
+	printfkernel("uaddr is:0x%016llx\n", uaddr);
+
+	copyout(&kernel_base, uaddr, 8);
+
+	return 0;
+}
+
+int _main(struct thread *td) {
+
+	initKernel();	
+	initLibc();
+	initNetwork();
+	initPthread();
+
+	struct sockaddr_in server;
+
+	server.sin_len = sizeof(server);
+	server.sin_family = AF_INET;
+	server.sin_addr.s_addr = IP(192, 168, 1, 12);
+	server.sin_port = sceNetHtons(9023);
+	memset(server.sin_zero, 0, sizeof(server.sin_zero));
+	sock = sceNetSocket("debug", AF_INET, SOCK_STREAM, 0);
+	sceNetConnect(sock, (struct sockaddr *)&server, sizeof(server));
+	int flag = 1;
+	sceNetSetsockopt(sock, IPPROTO_TCP, TCP_NODELAY, (char *)&flag, sizeof(int));
 
+	printfsocket("Connected!\n");
+
+	uint64_t* dump = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+
+	printfsocket("Starting kernel patch...\n");
+
+	int sRet = syscall(11,kpayload,td,dump);
+
+	printfsocket("Kernel patched!\n");
+
 	printfsocket("Starting PS4 Linux Loader\n");
 
 	usbthing();
 
 	printfsocket("Done!\n");
+
 	sceNetSocketClose(sock);
 
 	return 0;
+
 }
 
 void usbthing()
 {
-	// Open bzImage file from USB
+
+	printfsocket("Open bzImage file from USB\n");
 	FILE *fkernel = fopen("/mnt/usb0/bzImage", "r");
 	fseek(fkernel, 0L, SEEK_END);
 	int kernelsize = ftell(fkernel);
 	fseek(fkernel, 0L, SEEK_SET);
 
-	// Open initramfs file from USB
+	printfsocket("Open initramfs file from USB\n");
 	FILE *finitramfs = fopen("/mnt/usb0/initramfs.cpio.gz", "r");
 	fseek(finitramfs, 0L, SEEK_END);
 	int initramfssize = ftell(finitramfs);
@@ -73,7 +164,7 @@ void usbthing()
 	printfsocket("kernelsize = %d\n", kernelsize);
 	printfsocket("initramfssize = %d\n", initramfssize);
 
-	// Sanity checks
+	printfsocket("Checks if the files are here\n");
 	if(kernelsize == 0 || initramfssize == 0) {
 		printfsocket("no file error im dead");
 		fclose(fkernel);
@@ -98,15 +189,16 @@ void usbthing()
 	fclose(fkernel);
 	fclose(finitramfs);
 
-	// Call sys_kexec
+	printfsocket("Call sys_kexec (153 syscall)");
 	syscall(153, kernel, kernelsize, initramfs, initramfssize, cmd_line);
 
 	free(kernel);
 	free(initramfs);
 
-	// Reboot PS4
+	printfsocket("Reboot PS4");
 	int evf = syscall(540, "SceSysCoreReboot");
 	syscall(546, evf, 0x4000, 0);
 	syscall(541, evf);
 	syscall(37, 1, 30);
+
 }