From 73d81d13cab886e72d7743a64b3358b6cc65a30a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?John=20T=C3=B6rnblom?= Date: Thu, 31 Aug 2023 23:42:53 +0200 Subject: [PATCH 1/2] add arbitrary syscall function --- crt/crt.c | 2 ++ crt/syscall.c | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) create mode 100644 crt/syscall.c diff --git a/crt/crt.c b/crt/crt.c index cba5739..8197ea6 100644 --- a/crt/crt.c +++ b/crt/crt.c @@ -15,6 +15,8 @@ extern int payload_main(struct payload_args *args); extern int libc_init(); extern int libkernel_init(); +extern int syscall_init(); + void __ps5sdk_crt_start(struct payload_args *args) { diff --git a/crt/syscall.c b/crt/syscall.c new file mode 100644 index 0000000..adb37c1 --- /dev/null +++ b/crt/syscall.c @@ -0,0 +1,33 @@ +/***************************************************** + * PS5 SDK - Syscall + * Implements the syscall() function by setting up + * registers manually, then jumping to a syscall + * instruction in libkernel. + ****************************************************/ + +#include + +static __attribute__ ((used)) long ptr_syscall; + +asm(".intel_syntax noprefix\n" + ".global syscall\n" + ".type syscall @function\n" + "syscall:\n" + " mov rax, rdi\n" // sysno + " mov rdi, rsi\n" // arg1 + " mov rsi, rdx\n" // arg2 + " mov rdx, rcx\n" // arg3 + " mov r10, r8\n" // arg4 + " mov r8, r9\n" // arg5 + " mov r9, qword ptr [rsp + 8]\n" // arg6 + " jmp qword ptr [rip + ptr_syscall]\n" // syscall + " ret\n" + ); + +int syscall_init(const struct payload_args *args) { + if(args->dlsym(0x2001, "getpid", &ptr_syscall)) { + return -1; + } + ptr_syscall += 0xa; + return 0; +} From 5dae4cc8d3f7480cd2f30b5cf52c82dfc37c2035 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?John=20T=C3=B6rnblom?= Date: Fri, 1 Sep 2023 00:40:14 +0200 Subject: [PATCH 2/2] init syscall() from crt --- crt/crt.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/crt/crt.c b/crt/crt.c index 8197ea6..d726661 100644 --- a/crt/crt.c +++ b/crt/crt.c @@ -11,8 +11,10 @@ #define ERR_CRT_UNKNOWN 0xDEAD0000 #define ERR_CRT_LIBKERNEL_INIT_FAIL 0xDEAD0001 #define ERR_CRT_MODULE_INIT_FAIL 0xDEAD0002 +#define ERR_CRT_SYSCALL_INIT_FAIL 0xDEAD0003 extern int payload_main(struct payload_args *args); +extern int syscall_init(struct payload_args *args); extern int libc_init(); extern int libkernel_init(); extern int syscall_init(); @@ -25,7 +27,12 @@ void __ps5sdk_crt_start(struct payload_args *args) // Dlsym must be initialized first to resolve everything else init_dlsym(args->dlsym); - // Kickstart libkernel and libc + // Kickstart syscall, libkernel and libc + if (syscall_init(args) != 0) { + rv = ERR_CRT_SYSCALL_INIT_FAIL; + goto out; + } + if (libkernel_init() != 0) { rv = ERR_CRT_LIBKERNEL_INIT_FAIL; goto out;