| View previous topic :: View next topic |
| Author |
Message |
ab5000
Joined: 06 May 2008
Posts: 74
|
 Posted: Sun Jun 22, 2008 10:28 pm Post subject: RE on pspnet.prx... |
 |
|
Hi.
I've done some RE on pspnet.prx (3.52) and i've discovered some interesting things. The first file I analysed was the "wlanscan" PSPSDK example. Then I've reversed the sceNetConfigUpInterface (also sceNet_lib_5216CBF5) function. In this function there are 2 IoCtls.
First the function saves the first argument $a0 (normally it's the string "wlan") to $s0. Then using memset it fills with 0 32 bytes from $a0 (so $a0 = 32 bytes). Using strncpy it inserts $s0 into the stack. then it does the first ioctl:
| Code: | a0 = 0 -> File Descriptor
a1 = (0xC020 << 16) | 0x6911 = 0xC0206911 -> Command
a2 = $sp -> Arguments (in the stack, with strncpy, the function saved the first argument, normally "wlan") |
if the ioctl fails (return code != 0) it returns. else do another ioctl:
| Code: | a0 = 0 -> File Descriptor
a1 = (0x8020 << 16) | 0x6910 = 0x80206910 -> Command
a2 = $sp -> Arguments (normally "wlan")
a3 = 1 |
i've found an interesting page. simply google "C0206911 ioctl" and open the first result. then search "C0206911" on it. the two commands are in this page. can someone identify this page? another strange thing is the FD: 0 is a valid FD, but when was it opened? i think this FD is a "bridge" to the kernel. if it is, the argument "wlan" can be simply a way to tell the kernel on what device you want to control.
what do you think?
ab5000.
Last edited by ab5000 on Sun Jun 22, 2008 11:43 pm; edited 1 time in total |
|
| Back to top |
|
 |
adrahil
Joined: 16 Mar 2006
Posts: 277
|
| Posted: Sun Jun 22, 2008 11:20 pm Post subject: |
|
|
What you stumbled on on google is the OpenVMS TCP/IP services specification, which is probably the base of the PSP's networking system. (Is SCE so cheap that they hire retired OpenVMS engineers as system designers?)
Anyways, it's good you found that page, as now it will be possible to map the sceNet ioctls and probably find out a few more sceNet function names... |
|
| Back to top |
|
|
ab5000
Joined: 06 May 2008
Posts: 74
|
| Posted: Sun Jun 22, 2008 11:42 pm Post subject: |
|
|
i've looked at other IoCtls on pspnet. The form of the command is the same:
| Code: | lui $v0, 0xAAAA
ori $a1, $v0, 0xBBBB |
so:
| Code: | $v0 = 0xAAAA << 16
$a1 = $v0 | 0xBBB |
| Code: | | $a1 = (0xAAAA << 16) | 0xBBBB |
|
|
| Back to top |
|
|
hlide
Joined: 10 Sep 2006
Posts: 750
|
| Posted: Mon Jun 23, 2008 3:18 am Post subject: |
|
|
| adrahil wrote: | What you stumbled on on google is the OpenVMS TCP/IP services specification, which is probably the base of the PSP's networking system. (Is SCE so cheap that they hire retired OpenVMS engineers as system designers?)
Anyways, it's good you found that page, as now it will be possible to map the sceNet ioctls and probably find out a few more sceNet function names... |
nah ! this command is SIOCGIFFLAGS and if you google it, you'll find it is present in several OSes like Linux/SOLARIS/HP-UX. So i'm doubtful Sony hire any OpenVMS engineers :P. |
|
| Back to top |
|
|
adrahil
Joined: 16 Mar 2006
Posts: 277
|
|
| Back to top |
|
|
ab5000
Joined: 06 May 2008
Posts: 74
|
| Posted: Mon Jun 23, 2008 4:20 am Post subject: |
|
|
A partial list of commands:
| Code: | sceNet_lib_B755FA98
Command 1 = (0xC020 << 16) | 0x69D4 = 0xC02069D4
Command 2 = (0xC018 << 16) | 0x69D6 = 0xC01869D6 |
| Code: | sceNet_lib_D5B64E37
Command 1 = (0xC020 << 16) | 0x69D4 = 0xC02069D4
Command 2 = (0xC018 << 16) | 0x69D6 = 0xC01869D6
Command 3 = (0xC020 << 16) | 0x69D4 = 0xC02069D4
Command 4 = (0xC018 << 16) | 0x69D6 = 0xC01869D4
Command 5 = (0xC018 << 16) | 0x69D5 = 0xC01869D5 |
| Code: | sceNet_lib_DA02F383
Command 1 = (0xC014 << 16) | 0x69D8 = 0xC01469D8 |
| Code: | sceNet_lib_83FE280A
Command 1 = (0x8014 << 16) | 0x69DD = 0x801469DD |
Note that:
| Code: | | (0xAAAA << 16) | 0xBBB = 0xAAAABBBB |
because:
| Code: | 0xAAAA << 16 = 0xAAAA0000
1 OR 1 = 1
1 OR 0 = 1
0 OR 1 = 1
0 OR 0 = 0
0xAAAA0000 | 0x0000BBBB = 0xAAAABBBB |
|
|
| Back to top |
|
|
hlide
Joined: 10 Sep 2006
Posts: 750
|
| Posted: Mon Jun 23, 2008 5:09 am Post subject: |
|
|
and ?
why are you trying to teach us how to get a 32-bit constant through a LUI/ORI pair so hard ?
| Quote: | Note that:
Code:
(0xAAAA << 16) | 0xBBB = 0xAAAABBBB |
i would say : 0xAAAA0BBB :P
more seriously, if you plan to give us a detail list, you should insist on getting their (hypothetical) associated names rather teaching us how to get those numbers. |
|
| Back to top |
|
|
adrahil
Joined: 16 Mar 2006
Posts: 277
|
| Posted: Mon Jun 23, 2008 5:13 am Post subject: |
|
|
| Try to find out what those commands DO.... It will be better :) |
|
| Back to top |
|
|
ab5000
Joined: 06 May 2008
Posts: 74
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
