Editing PS3 Payload Development

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
== Payload benefits (peek/poke advantages in general) ==
=== Preface ===
To make changes to system, without the need (and risk) for hardpatching while making on-demand/live patches possible.
=== About KDSBest ===
I'm working as an software engineer. I started developing software when i was an 12 years old kid. Later i started working on my reversing and hackings skills. I always wanted to jump on a console hacking scene. I was always well informed about the different console scenes, but most scene start with a nearly full hack, PS3 is different, nothing was known when the PSJailbreak Team came up with his hack. Now here i am, trying to help developers to develope payloads. I learn at the moment alot myself, so don't blame me to hard if i make an mistake. ;)  


* Experiment with CoreOS elements to gain more insight in GameOS/Hypervisor
KDSBest's Twitter
* On-demand patching (e.g. Hermes' dirty Gamepad patch only when needed)
 
* Live patching
=== Assembler is dead -.- ===
* Make it easier to maintain
It's true, almost no one need assembler anymore but for reversing we need it, because we need to understand what the CPU does. In alot cases we just have an dump to extract this information. I use the PL3 lv2_dump_analyser.idc script to reverse my lv2 dump with IDA.


== PPU/SPU Assembler ==
It's true, almost no one need assembler anymore but for reversing we need it, because we need to understand what the CPU does. In alot cases we just have a dump to extract this information. I use the PL3 lv2_dump_analyser.idc script to reverse my lv2 dump with IDA.


=== Resources ===
=== Resources ===
* [http://publib.boulder.ibm.com/infocenter/aix/v6r1/index.jsp? IBM Instruction Set]
IBM Instruction Set
* [http://pds.twi.tudelft.nl/vakken/in101/labcourse/instruction-set/ Another Instruction Set]
 
 
Another Instruction Set


== PL3 ==
https://github.com/kakaroto/PL3


===Structure of PL3 ===
Thanks to KaKaRoToKS


=== Why do we develope Payloads?  ===
There are alot reasons. I give you some:
*Want to have a better knowledge about the GameOS/Hypervisor
*Want to play backups (Hermes Gamepad patch etc.)
*Want to cheat or modify a game
*Want to have fun
*...
=== PL3 ===
Structure of PL3
payload_dev.S Is the main "File", this includes everything and has the jailbreak in it (payload_main:)  
payload_dev.S Is the main "File", this includes everything and has the jailbreak in it (payload_main:)  


Line 25: Line 34:
'''firmware_symbols.h.S''' Defines the most common firmware Symbols (ex. strncmp)  
'''firmware_symbols.h.S''' Defines the most common firmware Symbols (ex. strncmp)  


'''map_open_path.h.S''' Base function for the Syscall 35 which is added.
'''map_open_path.h.S''' Base function for the Syscall 35 which is added. (dunno much about it at the moment)


'''memory_patching.h.S'''
'''memory_patching.h.S''' dunno at the moment


'''send_eth.h.S''' Function used to init the eth device.  
'''send_eth.h.S''' Function used to init the eth device.  
Line 33: Line 42:
'''send_eth_res.h.S''' Function for sending data via eth. (Protocol is 0x1337)  
'''send_eth_res.h.S''' Function for sending data via eth. (Protocol is 0x1337)  


'''memory_patching_res.h.S'''
'''memory_patching_res.h.S''' dunno at the moment


'''dev_syscalls.h.S''' Peek and Poke functions  
'''dev_syscalls.h.S''' Peek and Poke functions  
Line 58: Line 67:
=== Handy Macros ===
=== Handy Macros ===
'''MEM_BASE2''' is defined in the '''firmware_symbols.h.S'''  
'''MEM_BASE2''' is defined in the '''firmware_symbols.h.S'''  
<pre>#define ADDR_IN_PAGE(target) (PAYLOAD_OFFSET_IN_PAGE + (target) - payload_entry)</pre>
 
'''ADDR_IN_PAGE'''
<pre>
#define ADDR_IN_PAGE(target) (PAYLOAD_OFFSET_IN_PAGE + (target) - payload_entry)
</pre>


'''ADDR_IN_MEM2''' calculates the adress relative to the RESIDENT_AREA_OFFSET (resident_area_start)  
'''ADDR_IN_MEM2''' calculates the adress relative to the RESIDENT_AREA_OFFSET (resident_area_start)  
<pre>#define ADDR_IN_MEM2(target) ((target) - RESIDENT_AREA_OFFSET)</pre>
<pre>#define ADDR_IN_MEM2(target) ((target) - RESIDENT_AREA_OFFSET)</pre>


'''ABSOLUTE_MEM2'''
'''ABSOLUTE_MEM2''' calculates the adress relative to the current position. So you can give your banches an absolute memory address and it calculates the branch address to it for you.  
calculates the adress relative to the current position. So you can give your banches an absolute memory address and it calculates the branch address to it for you.  


<pre>// Absolute branching
<pre>// Absolute branching
Line 105: Line 119:
// makes it easy since PPC is big endian.
// makes it easy since PPC is big endian.


  1. define QUAD_MEM2(address) \
1. define QUAD_MEM2(address) \


.long 0x80000000; \
.long 0x80000000; \
Line 111: Line 125:


<pre>/* Patch Table Macros */
<pre>/* Patch Table Macros */
  1. define PATCH_INST(offset, instruction...) \
1. define PATCH_INST(offset, instruction...) \


.long offset; \
.long offset; \
Line 198: Line 212:
bl pl3_memcpy; \
bl pl3_memcpy; \
</pre>
</pre>
Source codes are from PL3


=== Understanding the Hack ===
=== Understanding the Hack ===
(section never written)
=== Patching ===
=== Patching ===
(section never written)
=== Hooking a function (strncmp) ===
=== Hooking a function (strncmp) ===
I try to explain how to do it with the PL3. PL3 loads a patch_table (see below). This patches are applied to the memory.  
I try to explain how to do it with the PL3. PL3 loads a patch_table (see below). This patches are applied to the memory.  
Line 312: Line 323:
Now our strncmp gets hooked and our function will get called and we jump back to the strncmp.  
Now our strncmp gets hooked and our function will get called and we jump back to the strncmp.  


Why this won't work that easy and why we jump to "strncmp+4" will be more clear in "Recreate overwritten code".
Why this won't work that easy and why we jump to "strncmp+4" will be more clear in "Recreate overwritten code".  


=== Recreate overwritten code ===
=== Recreate overwritten code ===
Line 407: Line 418:
#endif
#endif
</pre>
</pre>
That we jump to "strncmp+4" should be clear now, we have to "overjump" our branch to hook_strncmp.
That we jump to "strncmp+4" should be clear now, we have to "overjump" our branch to hook_strncmp.  


=== Saving the Register ===
=== Saving the Register ===
Line 492: Line 503:


=== Modify a function  ===
=== Modify a function  ===
(section never written)
=== Doing our own crap  ===
=== Doing our own crap  ===
(section never written)
=== Debug via ETH  ===
=== Debug via ETH  ===
Using payloader3 in combination with [https://github.com/AerialX/Kammy kammy] you are able to receive debug via udp over ethernet.
(linux instructions)
# Build payloader3 from the latest source<br/>
# Install the payloader3 pkg on the ps3<br/>
# This may a good place to set export in terminal<br/>
## export PS3LOAD=tcp:ipaddress.of.ps3<br/>
## start socat (socat udp-recv:18194 stdout)<br/>
# Launch payloader3 pkg from ps3<br/>
# Its quite possible you will not be able to see the screen but you will hear a sound this sound is said to be from and old C64 Demo, certain actions can be performed here:
## X then Square will launch ps3load with ethdebug<br/>
## X then circle will return back to the xmb loading ethdebug (for debuging pkg files)<br/>
# When using ps3load mode send self to your ps3 (ps3load selfile.self), you should be seeing debug in your teminal<br/>
# if not using ps3load you will be taken back to xmb where you can load a pkg file and will see debugging in  terminal
=== Creating a Syscall (explained on Peek & Poke)  ===
=== Creating a Syscall (explained on Peek & Poke)  ===
(section never written)
=== What next? ===
 
=== Compiling PL3 (debian/Ubuntu 10.10) ===
 
====Prerequisites====
Use your package manager to install everything required. Debian systems often need the -dev version of each package.<br />
 
{{info|content=
If you are installing on a system and you do not have root access, then the admin will have to do this command for you and you may need to install the binaries into your home directory
}}
 
* autoconf
* bison
* build-essential
* cpp-4.3
* curl
* g++-4.3
* gcc-4.3
* git-core
* gnupg flex
* gperf
* libesd0-dev
* libncurses5-dev
* libsdl1.2-dev
* libwxgtk2.6-dev
* texinfo
* zip
* zlib1g-dev
 
==== HowTo : Step by step ====
First thing we need to do is install some applications through apt, so open a terminal and do the following:
 
{{keyboard|content=<syntaxhighlight lang="bash">
sudo apt-get install git-core gnupg flex bison gperf libsdl1.2-dev libesd0-dev libwxgtk2.6-dev \
build-essential zip curl libncurses5-dev zlib1g-dev gcc-4.3 cpp-4.3 g++-4.3 texinfo autoconf
</syntaxhighlight>}}
 
Now we need to clone PSFreedom from github to our local PC, pull it's submodules and get the toolchain installed
 
{{keyboard|content=<syntaxhighlight lang="bash">
cd ~/
git clone git://github.com/kakaroto/PSFreedom.git
cd PSFreedom
git submodule update --init
cd pl3
git submodule update --init
cd ps3toolchain
sudo ./toolchain-sudo.sh
</syntaxhighlight>}}
 
Now go get a Coffee/sleep, installing the toolchain can take a few hours (6-7 hours if you are running Ubuntu in a Virtual PC)
 
Ok, so you have had your Coffee or sleep and you have the toolchain installed & PSFreedom cloned to your home directory, the hard part is over.
 
Now you need to edit your .bashrc file:
 
{{keyboard|content=<syntaxhighlight lang="bash">gedit ~/.bashrc</syntaxhighlight>}}
 
Add the following line to the end of the file:
 
{{keyboard|content=<syntaxhighlight lang="bash">export PATH=${PATH}:/usr/local/ps3dev/ppu/bin/</syntaxhighlight>}}


To compile PSFreedom's payloads is simple now, open a terminal and do the following:
Credit
Tutorial written by KDSBest


{{keyboard|content=<syntaxhighlight lang="bash">
Thanks to
cd ~/PSFreedom/pl3
KaKaRoToKS
make
</syntaxhighlight>}}


That's it, you can now find the payload .bin files in the PSFreedom/pl3 folder.
Mathieulh


== Other ==
Hermes
* https://github.com/psgroove
* https://github.com/kakaroto/PSFreedom


brandonw


''Palmam qui meruit ferat''
Irv


phirenz




{{Development}}<noinclude>[[Category:Main]]</noinclude>
Retrieved from "http://ps3wiki.lan.st/index.php/PS3_Payload_Developement"
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)