diff --git a/shellcode_hypervisor/Makefile b/shellcode_hypervisor/Makefile index f7aef28..ae572e2 100644 --- a/shellcode_hypervisor/Makefile +++ b/shellcode_hypervisor/Makefile @@ -36,4 +36,4 @@ clean: rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump) $(dump): $(TEXT_BIN) - python3 bin_to_c_hypervisor.py $(TEXT_BIN) + xxd -i $(TEXT_BIN) > $(dump) diff --git a/shellcode_hypervisor/bin_to_c_hypervisor.py b/shellcode_hypervisor/bin_to_c_hypervisor.py deleted file mode 100644 index 42e2265..0000000 --- a/shellcode_hypervisor/bin_to_c_hypervisor.py +++ /dev/null @@ -1,46 +0,0 @@ -import sys -import os - -def create_shellcode_header(input_file): - if not os.path.exists(input_file): - print(f"Error: {input_file} not found.") - return - - # Read binary data_text - with open(input_file, "rb") as f: - data_text = f.read() - - # Hardcoded output name - output_name = "shellcode_hypervisor.h" - array_name = "shellcode_hypervisor" - - with open(output_name, "w") as f: - f.write(f"// Generated from {input_file}\n") - f.write(f"#ifndef SHELLCODE_HV_H\n") - f.write(f"#define SHELLCODE_HV_H\n\n") - f.write(f"#include \n\n") - - f.write(f"uint8_t {array_name}[] = {{\n ") - - for i, byte in enumerate(data_text): - f.write(f"0x{byte:02X}") - - if i < len(data_text) - 1: - f.write(", ") - - # New line every 12 bytes - if (i + 1) % 12 == 0: - f.write("\n ") - - f.write(f"\n}};\n\n") - f.write(f"uint64_t {array_name}_len = {len(data_text)};\n\n") - - f.write(f"#endif // SHELLCODE_HV_H\n") - - print(f"Done! Created {output_name} ({len(data_text)} bytes)") - -if __name__ == "__main__": - if len(sys.argv) < 2: - print("Usage: python bin_to_c_hypervisor.py ") - else: - create_shellcode_header(sys.argv[1]) diff --git a/shellcode_kernel/Makefile b/shellcode_kernel/Makefile index e09f6ac..05a3cc4 100644 --- a/shellcode_kernel/Makefile +++ b/shellcode_kernel/Makefile @@ -15,7 +15,7 @@ endif CFLAGS = -O2 -fno-stack-protector -ffreestanding -nostdlib -m64 -I$(PS5_PAYLOAD_SDK)/target/include LDFLAGS = -T linker.ld TARGET = shellcode_kernel.elf -TEXT_BIN = shellcode_text.bin +TEXT_BIN = shellcode_kernel.bin SRC = main.c utils.c kernel_code.c OBJ = $(SRC:.c=.o) @@ -37,4 +37,4 @@ clean: rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump) $(dump): $(TEXT_BIN) - python3 bin_to_c_kernel.py $(TEXT_BIN) + xxd -i $(TEXT_BIN) > $(dump) diff --git a/shellcode_kernel/bin_to_c_kernel.py b/shellcode_kernel/bin_to_c_kernel.py deleted file mode 100644 index be19b7e..0000000 --- a/shellcode_kernel/bin_to_c_kernel.py +++ /dev/null @@ -1,48 +0,0 @@ -import sys -import os - -def create_shellcode_header(input_file_text): - if not os.path.exists(input_file_text): - print(f"Error: {input_file_text} not found.") - return - - # Read binary data_text - with open(input_file_text, "rb") as f: - data_text = f.read() - - # Hardcoded output name - output_name = "shellcode_kernel.h" - array_name_text = "shellcode_kernel_text" - - with open(output_name, "w") as f: - f.write(f"// Generated from {input_file_text}\n") - f.write(f"#ifndef SHELLCODE_KERNEL_H\n") - f.write(f"#define SHELLCODE_KERNEL_H\n\n") - f.write(f"#include \n\n") - - f.write(f"#include \"shellcode_kernel_args.h\"\n\n") - - f.write(f"uint8_t {array_name_text}[] = {{\n ") - - for i, byte in enumerate(data_text): - f.write(f"0x{byte:02X}") - - if i < len(data_text) - 1: - f.write(", ") - - # New line every 12 bytes - if (i + 1) % 12 == 0: - f.write("\n ") - - f.write(f"\n}};\n\n") - f.write(f"uint64_t {array_name_text}_len = {len(data_text)};\n\n") - - f.write(f"#endif // SHELLCODE_KERNEL_H\n") - - print(f"Done! Created {output_name} ({len(data_text)} bytes)") - -if __name__ == "__main__": - if len(sys.argv) < 2: - print("Usage: python bin_to_c_kernel.py ") - else: - create_shellcode_header(sys.argv[1]) diff --git a/shellcode_kernel/kernel_code.c b/shellcode_kernel/kernel_code.c index 0920ef3..95c8a9e 100644 --- a/shellcode_kernel/kernel_code.c +++ b/shellcode_kernel/kernel_code.c @@ -1,8 +1,10 @@ #include "kernel_code.h" #include "../include/config.h" #include "../shellcode_hypervisor/shellcode_hypervisor.h" +#include "../shellcode_hypervisor/shellcode_hypervisor_args.h" #include "shellcode_kernel_args.h" #include "utils.h" +#include #define DIG1TRANSMITTERCONTROL 0x4c @@ -118,8 +120,8 @@ static void patch_hv(void) { } // Install hv_shellcode 2 - memcpy((void *)PHYS_TO_DMAP(cave_hv_code), shellcode_hypervisor, - shellcode_hypervisor_len); + memcpy((void *)PHYS_TO_DMAP(cave_hv_code), shellcode_hypervisor_bin, + shellcode_hypervisor_bin_len); // Jump to shellcode final identity mapping uint8_t shellcode_jmp[] = { diff --git a/source/main.c b/source/main.c index b503bae..3faa50a 100644 --- a/source/main.c +++ b/source/main.c @@ -1,5 +1,6 @@ #include "main.h" #include "../shellcode_kernel/shellcode_kernel.h" +#include "../shellcode_kernel/shellcode_kernel_args.h" #include "hv_defeat.h" #include "loader.h" #include "offsets.h" @@ -74,13 +75,13 @@ int prepare_resume(void) { ktext + env_offset.KERNEL_DATA_CAVE; // For arguments only, rest of .data // variables are in shellcode - uint64_t sz = shellcode_kernel_text_len; + uint64_t sz = shellcode_kernel_bin_len; uint32_t CHUNK = 0x1000; uint64_t written = 0; while (written < sz) { uint32_t n = (sz - written > CHUNK) ? CHUNK : (uint32_t)(sz - written); - kernel_copyin(&shellcode_kernel_text[written], dest_text + written, n); + kernel_copyin(&shellcode_kernel_bin[written], dest_text + written, n); written += n; } DEBUG_PRINT(" copied %d bytes to text cave\n", sz); @@ -142,7 +143,7 @@ int prepare_resume(void) { // overwrite it with proper VA in .data for arguments int offset = -1; for (int i = 0; i < 0x40; i++) { - if (*(uint64_t *)((uint64_t)shellcode_kernel_text + i) == + if (*(uint64_t *)((uint64_t)shellcode_kernel_bin + i) == 0x11AA11AA11AA11AA) { offset = i; break;