| View previous topic :: View next topic |
| Author |
Message |
Super Sheep
Joined: 23 Mar 2008
Posts: 31
|
 Posted: Fri Oct 17, 2008 6:21 am Post subject: Hooking Usermode Functions |
 |
|
Right, this is a bit of pain lately. I'm hooking various functions located in the Paf and I can correctly replace the JAL's with the Syscalls to the function in my kernel module. However, when I try to call the original function (in Paf) it always crashes (obviously). I am however at loss as I do not want to create a usermode module and would rather keep it all in one kernel mode module.
Any help? If you need anymore information just ask.
Thanks a lot. |
|
| Back to top |
|
 |
angelo
Joined: 29 Aug 2007
Posts: 168
|
| Posted: Fri Oct 17, 2008 7:25 am Post subject: |
|
|
I need to make a PRX in the appropriate mode and then load it. This scenario was common for audio I believe.
Angelo |
|
| Back to top |
|
|
Super Sheep
Joined: 23 Mar 2008
Posts: 31
|
| Posted: Fri Oct 17, 2008 7:39 am Post subject: |
|
|
| Hmm, I'm trying to not load another module. Surely there is a way to execute a usermode function under kernel mode? |
|
| Back to top |
|
|
moonlight
Joined: 26 Oct 2005
Posts: 567
|
| Posted: Fri Oct 17, 2008 8:09 am Post subject: |
|
|
Well, there is an exotic way to do that...
sceKernelSetDdrMemoryProtection((void *)0x08000000, 2*1024*1024, 0xF);
after that you would be able to redirect a user call to a kernel function replacing a jal by other jal, and the function will execute in user mode. Of course, if you call kernel functions inside that function, you may expect a crash... |
|
| Back to top |
|
|
Super Sheep
Joined: 23 Mar 2008
Posts: 31
|
| Posted: Fri Oct 17, 2008 8:23 am Post subject: |
|
|
| I'll give that a shot. I'll post back with results. |
|
| Back to top |
|
|
Super Sheep
Joined: 23 Mar 2008
Posts: 31
|
| Posted: Fri Oct 17, 2008 8:55 am Post subject: |
|
|
| It crashes when the patched function is first executed. Damn. |
|
| Back to top |
|
|
angelo
Joined: 29 Aug 2007
Posts: 168
|
| Posted: Fri Oct 17, 2008 9:03 am Post subject: |
|
|
Just use a shim by using a user / kernel PRX and loadstart it. It may be your only way...
Angelo |
|
| Back to top |
|
|
Super Sheep
Joined: 23 Mar 2008
Posts: 31
|
| Posted: Fri Oct 17, 2008 9:17 am Post subject: |
|
|
| I'd rather not. I believe user memory is very limited in VSH. I'd rather keep away from it. |
|
| Back to top |
|
|
Super Sheep
Joined: 23 Mar 2008
Posts: 31
|
| Posted: Fri Oct 17, 2008 11:47 pm Post subject: |
|
|
Is there any other alternatives?
| Code: | #include <pspkernel.h>
#include <pspsysmem_kernel.h>
#include <pspsdk.h>
#include <systemctrl.h>
#include <string.h>
#include "debugutils.h"
PSP_MODULE_INFO("UserHook", 0x1000, 1, 0);
#define MAKE_CALL(a, f) _sw(0x0C000000 | (((u32)(f) >> 2) & 0x03ffffff), a);
int (*scePafMemoryAlloc)(int, int) = NULL;
STMOD_HANDLER previous = NULL;
int scePafMemoryAllocPatched(int allignment, int size)
{
return scePafMemoryAlloc(allignment, size);
}
int OnModuleStart(SceModule2 *mod)
{
char *modname = mod->modname;
u32 text_addr = mod->text_addr;
if (strcmp(modname, "vsh_module") == 0)
{
scePafMemoryAlloc = (void *)FindProc("scePaf_Module", "scePaf", 0x31AC0624);
MAKE_CALL(text_addr + 0xB3D8, scePafMemoryAllocPatched);
sceKernelDcacheWritebackAll();
sceKernelIcacheClearAll();
}
if (!previous)
return 0;
return previous(mod);
}
int module_start(SceSize args, void *argp)
{
sceKernelSetDdrMemoryProtection((void *)0x08000000, 2*1024*1024, 0xF);
previous = sctrlHENSetStartModuleHandler(OnModuleStart);
return 0;
} |
Thats my code, all updated for 5.00 but it crashes =/
Got any other suggestions? Moonlight? Anyone? |
|
| Back to top |
|
|
adrahil
Joined: 16 Mar 2006
Posts: 277
|
| Posted: Sun Oct 19, 2008 12:33 am Post subject: |
|
|
| Super Sheep wrote: | | I'd rather not. I believe user memory is very limited in VSH. I'd rather keep away from it. |
Uhm....
if you search for a way to do it without another PRX, the way will be more complex and will take up more space than a dumb prx... Plus, there is plenty memory in VSH if you know where to look. |
|
| Back to top |
|
|
TyRaNiD
Joined: 18 Jan 2004
Posts: 918
|
| Posted: Sun Oct 19, 2008 2:27 am Post subject: |
|
|
I am assuming you want to call the function then do something with the result rather than just hooking the entry to the function, this makes it harder.
You _could_ implement a trick using exception handlers to do it. Stick in a 'break' instruction in the delay slot of the j address; nop; import for the function in the module you want to hook then it will crash when the function is called. You could catch this and hand off to a function to handle your side of it, when you need to call the original you can either just tweak EPC to point to the actual function and return from the exception, which would not return back to you, or you change the saved RA register then when the function returns it crashes again at an appropriately selected address (so you can decode which function it was) and so an epilog for the function.
Of course it is just simpler to use a dumb user mode prx as adrahil has pointed out :) |
|
| Back to top |
|
|
Super Sheep
Joined: 23 Mar 2008
Posts: 31
|
| Posted: Sun Oct 19, 2008 2:33 am Post subject: |
|
|
| I'll just load a usermode prx in the volatile memspace and leech off the paf libc =P |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
