forums.ps2dev.org

Hellcat · Joined: 24 Jan 2007 Posts: 84

I know I'm probably going to be stoned to death, but I'll take my chance and ask anyway....

Let's say I have a small block of raw ASM code, injected to somewhere in the PSPs RAM and jumped in to.

Is there a good and known way of calling syscalls (like sceIoOpen and stuff) from there?
Since I'm not having any imports and the like I can't think of a decent way of doing that (besides manually letting the code run through the whole RAM to find the libs I need and fetch the adresses of the calls).

Any hint to make it more easy? :)

Secondly, how do I get the compiler to just make a plain binary from some ASM source, w/o headers, footers or anything else....

Any help apreciated, thanks :)

J.F. · Joined: 22 Feb 2004 Posts: 2906

Firstly, you want to just use GAS, the gnu assembler. It's part of the normal toolchain. Look at gas tutorials for the x86, then substitute MIPS for x86. You'll find various .s and .S files in the PSP SDK source you can look at for examples of syntax. The difference is the .S files are run through the c preprocessor so that you can make defines and such just like with c, even though it's assembly.

For example, in a .s file you would define a constant like this:

Hellcat · Joined: 24 Jan 2007 Posts: 84

Thanks :) That already helps alot!

What I don't get is, when I just do a "jal sceKernelDelayThread", where and how does it get the actual address of "sceKernelDelayThread" to jump to?

Anyway, this is enough to get started already, I think, thanks again! :)

FreePlay · Posted: Sat Jan 03, 2009 3:06 pm Post subject:

J.F.,

I think he's trying to go about using functions without requiring *any* external code.

J.F. · Joined: 22 Feb 2004 Posts: 2906

You mean building the code on the fly inside the app, like Dynamic Recompiling? Same statements still apply, he just has to "compile" the code himself, ORing the address of the function into the opcode for JAL and then storing that at the correct location in memory, then flushing the data cache and invalidating the code cache. That's quite a bit more complex, but still follows the same guidelines as far as the assembly language goes.

The function addresses for the SDK functions are done the way any function address is.

Torch · Joined: 28 May 2008 Posts: 842

I don't understand how this works either.

Bubbletune · Joined: 03 Jan 2009 Posts: 28

I use this trick a lot when I want a small snippet of code to reside in user memory (I don't know if that's what you want to do but it's a great example so I'll just use that here :P), I just allocate a user heap and copy some pure assembly code in there, then hook a function in user memory with it. :) Anyways, you'll need to do some dynamic linking on the buffer, both jumps, syscalls, imports and accessing of global memory.

Instead of seperately compiling it as a binary, I usually use MIPS opcode macros in C code, such as these. Copy the entire bit from [--- NEW FILE: mips-codegen.h ---] till [--- NEW FILE: test.c ---] (the end of the mips-codegen.h file) in a seperate header file and save it. Note that the 'j' instruction is called mips_jump, and the 'jal' instruction is called mips_jumpl in that header file, but you're free to change it.

Include it in your code and you can use it like this:

ne0h · Joined: 21 Feb 2008 Posts: 386

Torch · Joined: 28 May 2008 Posts: 842

But when you need to write code, such as code which an exploit jumps into, how would external calls be resolved then? In such cases you would need to manually find the functions right?

Hellcat · Joined: 24 Jan 2007 Posts: 84

Bubbletune · Joined: 03 Jan 2009 Posts: 28

Torch · Joined: 28 May 2008 Posts: 842

Bubbletune · Joined: 03 Jan 2009 Posts: 28

Torch · Joined: 28 May 2008 Posts: 842

ne0h · Joined: 21 Feb 2008 Posts: 386

Hellcat,
do you know how to get functions address only of the functions imported by the game?
_________________
Get Xplora!

Hellcat · Joined: 24 Jan 2007 Posts: 84

You can use PRXTool to do disasm of the main binary executable of the game, it will give you the stub adresses for everything the game imports.

You can the use those to call the functions the game imports.

That's what has been done for the Sparta-SDK by Freeplay and MaTiAz.

ne0h · Joined: 21 Feb 2008 Posts: 386

Ok, good...
Now, we have some sceKernelLoad\Start* functions, I've see that some modules in the UMD are not compressed with ~SCE or ~PSP signature, only plain ELF, can I load another module with my own imports?
I know that prabably is not possible but why?
_________________
Get Xplora!

Torch · Joined: 28 May 2008 Posts: 842

ne0h · Joined: 21 Feb 2008 Posts: 386

Yes but, some files like mpeg.prx are not encrypted, how is it loaded?
Have this ELFs the Sony signature or something else? or are simple ELF files?
EDIT:
I've that only the user mode prx's is unencrypted, why?
There's no signcheck on user modules???
_________________
Get Xplora!

Fanjita · Joined: 28 Sep 2005 Posts: 217

To answer the original question : there's an opcode, syscall 0xnnnn, which will directly invoke a syscall.

The tricky part is figuring out what the syscall ID that you want is. In the early days, syscall tables were static, varying only depending on the firmware and mode (VSH, game, etc.) in use.

But later firmwares (from around 2.50) started messing with that to make it harder to do exploits. Suffice to say, the most reliable way to find the syscall ID for a given function now is to find it imported by another module in your current environment, and read the syscall opcode from that module's import table.

But if you can find it already imported, then as has been said elsewhere, you might as well just jump into the jump table in the import data.

If you want to mess with this stuff further, you'll need to look into how the ELF import tables are laid out (they're just done according to the ELF standards). Using that knowledge you can search through RAM for stuff that looks like a module import table, and retrieve the info you need.

You can PM me for further details if you want to take it further, I'm in the process of revisiting all this stuff for the gripshift exploit.
_________________
Got a v2.0-v2.80 firmware PSP? Download the eLoader here to run homebrew on it!
The PSP Homebrew Database needs you!

m0skit0 · Joined: 02 Jun 2009 Posts: 226

Awesome post!!! (sorry I had to say it)
_________________

kralyk · Posted: Sat Jul 18, 2009 3:04 am Post subject:

how about using mips sceKernelQuerySystemCall(desired_function)?

Whats the difference between jumping to a syscall directly and using sceKernelQuerySystemCall?
_________________
...sorry for my english...

Fanjita · Joined: 28 Sep 2005 Posts: 217

sKQuerySystemCall returns the syscall ID, IIRC.

That's the easy way to find the syscall ID if you happen to have access to kernel mode and have the function address / syscall ID for sKQuerySystemCall in hand.

But if you're working at a very low level in raw assembly and don't have access to niceties such as getting the loader to fix up your import table for you, then sKQuerySystemCall may just be a distant dream.
_________________
Got a v2.0-v2.80 firmware PSP? Download the eLoader here to run homebrew on it!
The PSP Homebrew Database needs you!