Editing QA Flagging

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 19: Line 19:


debug menu mini = qa_flags[3] & 0x2
debug menu mini = qa_flags[3] & 0x2
any_qaf = qa_flags[0] qa_flags[1] qa_flags[2] qa_flags[3] qa_flags[4] qa_flags[5] qa_flags[6] qa_flags[7] qa_flags[8] qa_flags[9] qa_flags[0xA] qa_flags[0xB] qa_flags[0xC] qa_flags[0xD] qa_flags[0xE] qa_flags[0xF] = 0xFF
</pre>
</pre>


Line 35: Line 33:
fake sharefactory = utoken_flags[0] & 0x80
fake sharefactory = utoken_flags[0] & 0x80
</pre>
</pre>
= Spoofing Flags =
* Search for kernel magic in kernel dump
* Set all values before kernel magic (16 in total) to FF
* Set all values after kernel magic (16 in total) to FF
* Open kernel dump in ida pro (use SocraticBliss's kernel loader for this)
* Search for the string "rcmgr" in hex bytes (searching as text is slower)
* Find the xref to the first string (usually intdev)
* Rename All the functions to their respective names
* Patch each function where the condition (word_FFFFFFFFXXXXXXXX & 54) != 0) applies in pseudocode (if the first jump is a jnz, it's the second jz, if the first jump is a jz, it's the second jz as well)
* Note down the patches and spoofs, as well as the name of the rcmgr flags (for example rcmgr_intdev)
* Create a code that escalates privileges, spoofs qa flags and utoken flags and calls sysctl by name of machdep.<name of rcmgr flag>
* Launch payload
* You should have everything unlocked (to use only the ones you want comment or uncomment the sysctlbyname funcs)
{{Reverse Engineering}}
<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps4/QA_Flagging"