| View previous topic :: View next topic |
| Author |
Message |
pspflashsystem
Joined: 24 Mar 2008
Posts: 31
|
 Posted: Sat Jan 03, 2009 4:00 am Post subject: Sysconf adress |
 |
|
Hi everyone,
I want to know how did certain developers do to know what is the adress of the firmware version in sysconf_plugin.prx (0x15EE0 in 5.00 firmware) ?
Excuse me if it's not clear but I want to know how :).
Thanks in advance and I'm apologize for my bad english because I'm French...
_________________
I'm apologize for my bad English because I am French :)
.::pspflashsystem::. |
|
| Back to top |
|
 |
Bubbletune
Joined: 03 Jan 2009
Posts: 28
|
| Posted: Sat Jan 03, 2009 7:00 am Post subject: |
|
|
It calls a function located in scePaf to get ahold of the version, but this function changes it's NID every 3 firmwares or so.
However, what really is usefull here is the second argument being passed, it's a string but Prxtool doesn't properly analyze the data references in new firmware modules, so it's a little harder to track back.
| Code: | 0x00015EDC: 0x3C050002 '...<' - lui $a1, 0x2
0x00015EE0: 0x0C008D68 'h...' - jal scePaf_970DC20D
0x00015EE4: 0x24A57C8C '.|.$' - addiu $a1, $a1, 31884 |
It fills the pointer to this string by combining the lui and addiu.
Lui fills the upper 16 bits (0x00020000), and addiu fills the lower 16 bits, ending up with 0x00027C8C.
If we search this address in the assembly, we find this:
| Code: | 0x00027C8C: 0x7367736D 'msgs' - Unknown
0x00027C90: 0x65726168 'hare' - Unknown
0x00027C94: 0x7265765F '_ver' - Unknown
0x00027C98: 0x6E6F6973 'sion' - Unknown
0x00027C9C: 0x00000000 '....' - nop |
This has been misidentified as assembly, but we can find the string, which is msgshare_version.
In later firmwares, simply look up this string again, then search for a reference to the address it's at, and you'll find the function to patch. :) |
|
| Back to top |
|
|
ne0h
Joined: 21 Feb 2008
Posts: 386
|
| Posted: Sat Jan 03, 2009 9:23 pm Post subject: |
|
|
mmm,
excuse me,
I've looked at scePaf_970DC20D function ( ofw 500) , and I've found this:
| Code: |
======================================================
; Subroutine scePaf_970DC20D - Address 0x000235A0
; Imported from scePaf
scePaf_970DC20D:
0x000235A0: 0x03E00008 '....' - jr $ra
0x000235A4: 0x00000000 '....' - nop
|
Why?
It's an empty function??
_________________
Get Xplora! |
|
| Back to top |
|
|
Bubbletune
Joined: 03 Jan 2009
Posts: 28
|
| Posted: Sat Jan 03, 2009 9:43 pm Post subject: |
|
|
| ne0h wrote: | mmm,
excuse me,
I've looked at scePaf_970DC20D function ( ofw 500) , and I've found this:
| Code: |
======================================================
; Subroutine scePaf_970DC20D - Address 0x000235A0
; Imported from scePaf
scePaf_970DC20D:
0x000235A0: 0x03E00008 '....' - jr $ra
0x000235A4: 0x00000000 '....' - nop
|
Why?
It's an empty function?? |
You're looking at the stub inside the vshmain module. You see, when modules import a function, those useless "stubs" are created and jumps towards it are placed. Once the ELF loader loads the actual module, it'll replace those useless instructions with a jump towards the scePaf_970DC20D exported from paf.prx. So, if you want to see the function, you need to look in paf.prx for scePaf_970DC20D. ;) |
|
| Back to top |
|
|
ne0h
Joined: 21 Feb 2008
Posts: 386
|
| Posted: Sat Jan 03, 2009 10:46 pm Post subject: |
|
|
Oh, sorry, another stupid question..
Thanks...
_________________
Get Xplora! |
|
| Back to top |
|
|
pspflashsystem
Joined: 24 Mar 2008
Posts: 31
|
| Posted: Sun Jan 04, 2009 2:51 am Post subject: |
|
|
Ok thanks Bubbletune : it's very good :)
I asked Davee today and said me the same thing ;)
So thanks Bubbletune :) :)
_________________
I'm apologize for my bad English because I am French :)
.::pspflashsystem::. |
|
| Back to top |
|
|
pspwill
Joined: 17 Nov 2005
Posts: 51
|
| Posted: Tue Jan 06, 2009 10:07 am Post subject: |
|
|
| Is there any sample code for doing this on say 1.5? |
|
| Back to top |
|
|
Super Sheep
Joined: 23 Mar 2008
Posts: 31
|
| Posted: Wed Jan 07, 2009 7:48 am Post subject: |
|
|
I don't think so.
There is sample code (well I guess) for 5.00 and 5.02 if you wanted it? |
|
| Back to top |
|
|
pspwill
Joined: 17 Nov 2005
Posts: 51
|
| Posted: Wed Jan 07, 2009 9:19 am Post subject: |
|
|
| no i wanted the code for 1.50 or the nid of the function for 1.50 |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
