ps5-linux/ps5-linux-loader
1
0
Fork 0
mirror of https://github.com/ps5-linux/ps5-linux-loader.git synced 2026-07-16 01:50:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add new hv exploit.

Browse Source
This commit is contained in:
Andy Nguyen
2026-05-17 11:54:10 +02:00
parent fbe5ae0c32
commit eb886e9467
22 changed files with 640 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files

129
source/offsets.c
View File

@@ -1,5 +1,7 @@
#include "offsets.h"
#define KERNEL_TEXT 0xFFFFFFFF80210000
offset_list off_0300 = {
.IOMMU_SOFTC = 0x33175E0,
.VMSPACE_VM_VMID = 0x1E4,
@@ -15,7 +17,6 @@ offset_list off_0300 = {
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x6282CBCB,
.KERNEL_UART_OVERRIDE = 0x1EB0258,
.KERNEL_DEBUG_PATCH = 0x0752460,
.KERNEL_CFI_CHECK = 0x0441DD0,
.G_VBIOS = 0x0734B5D0,
.FUN_TRANSMITTER_CONTROL = 0x0B2A560,
@@ -40,7 +41,6 @@ offset_list off_0310 = {
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x6282CBCB,
.KERNEL_UART_OVERRIDE = 0x1EB0258,
.KERNEL_DEBUG_PATCH = 0x07524A0,
.KERNEL_CFI_CHECK = 0x0441E10,
.G_VBIOS = 0x0734B5D0,
.FUN_TRANSMITTER_CONTROL = 0x0B2A5A0,
@@ -65,7 +65,6 @@ offset_list off_0320 = {
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x6282CBCB,
.KERNEL_UART_OVERRIDE = 0x1EB0258,
.KERNEL_DEBUG_PATCH = 0x7527F0,
.KERNEL_CFI_CHECK = 0x442160,
.G_VBIOS = 0x734B5D0,
.FUN_TRANSMITTER_CONTROL = 0xB2AA60,
@@ -90,7 +89,6 @@ offset_list off_0321 = {
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x6282CBCB,
.KERNEL_UART_OVERRIDE = 0x1EB0258,
.KERNEL_DEBUG_PATCH = 0x7527F0,
.KERNEL_CFI_CHECK = 0x442160,
.G_VBIOS = 0x734B5D0,
.FUN_TRANSMITTER_CONTROL = 0xB2AA60,
@@ -106,8 +104,8 @@ offset_list off_0400 = {
.VMSPACE_VM_PMAP = 0x1D0,
.DATA_BASE_GVMSPACE = 0x064C3F80,
.HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613,
.FUN_PRINTF = 0x4A3240,
.KERNEL_CODE_CAVE = 0x500,
.FUN_PRINTF = 0x4A3240,
.FUN_HV_IOMMU_SET_BUFFERS = 0xB638F0,
.FUN_HV_IOMM_WAIT_COMPLETION = 0xB63830,
.FUN_SMP_RENDEZVOUS = 0xA6C920,
@@ -115,7 +113,6 @@ offset_list off_0400 = {
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x6282B45D,
.KERNEL_UART_OVERRIDE = 0x1F522A8,
.KERNEL_DEBUG_PATCH = 0x77DA70,
.KERNEL_CFI_CHECK = 0x45A170,
.G_VBIOS = 0x72B7630,
.FUN_TRANSMITTER_CONTROL = 0xB5AD50,
@@ -140,7 +137,6 @@ offset_list off_0402 = {
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x6282B45D,
.KERNEL_UART_OVERRIDE = 0x1F522A8,
.KERNEL_DEBUG_PATCH = 0x77DAC0,
.KERNEL_CFI_CHECK = 0x45A170,
.G_VBIOS = 0x72B7630,
.FUN_TRANSMITTER_CONTROL = 0xB5ADA0,
@@ -165,7 +161,6 @@ offset_list off_0403 = {
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x6282B45D,
.KERNEL_UART_OVERRIDE = 0x1F522A8,
.KERNEL_DEBUG_PATCH = 0x77DB50,
.KERNEL_CFI_CHECK = 0x45A170,
.G_VBIOS = 0x72B7630,
.FUN_TRANSMITTER_CONTROL = 0xB5AE30,
@@ -190,7 +185,6 @@ offset_list off_0450 = {
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x6282B45D,
.KERNEL_UART_OVERRIDE = 0x1F522A8,
.KERNEL_DEBUG_PATCH = 0x77DC80,
.KERNEL_CFI_CHECK = 0x45A1A0,
.G_VBIOS = 0x72B7630,
.FUN_TRANSMITTER_CONTROL = 0xB5AFF0,
@@ -215,7 +209,6 @@ offset_list off_0451 = {
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x6282B45D,
.KERNEL_UART_OVERRIDE = 0x1F522A8,
.KERNEL_DEBUG_PATCH = 0x77DC90,
.KERNEL_CFI_CHECK = 0x45A1A0,
.G_VBIOS = 0x72B7630,
.FUN_TRANSMITTER_CONTROL = 0xB5B420,
@@ -224,3 +217,119 @@ offset_list off_0451 = {
.PS5_WIFI_FW_OFFSET = 0x1393000,
.PS5_WIFI_FW_SIZE = 493000,
};
offset_list off_0550 = {
// .IOMMU_SOFTC not needed
// .VMSPACE_VM_VMID not needed
.VMSPACE_VM_PMAP = 0x1D0,
// .DATA_BASE_GVMSPACE not needed
.ACPIGBL_FACS = (0xFFFFFFFF83C942A0 - KERNEL_TEXT),
.IDT = (0xFFFFFFFF8745DCA0 - KERNEL_TEXT),
.COMMON_TSS = (0xFFFFFFFF87460850 - KERNEL_TEXT),
.STOPPED_CPUS = (0xFFFFFFFF87520DE0 - KERNEL_TEXT),
.FUN_STOP_CPUS = (0xFFFFFFFF80CAC250 - KERNEL_TEXT),
.FUN_AS_LAPIC_EOI = (0xFFFFFFFF804486A0 - KERNEL_TEXT),
.FUN_HV_UNMAP_PT_TMR = (0xFFFFFFFF80DAA180 - KERNEL_TEXT),
.FUN_MEMCPY = (0xFFFFFFFF80489DF0 - KERNEL_TEXT),
.GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80b94dd4 - KERNEL_TEXT),
.GAD_IRETQ = (0xFFFFFFFF8044B02D - KERNEL_TEXT),
.GAD_POP_RDI_RET = (0xffffffff803e8738 - KERNEL_TEXT),
.GAD_POP_RSI_RET = (0xffffffff803a9270 - KERNEL_TEXT),
.GAD_POP_RDX_RET = (0xffffffff8054d4f2 - KERNEL_TEXT),
.GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff80603cba - KERNEL_TEXT),
// .HOOK_ACPI_WAKEUP_MACHDEP not needed
.KERNEL_CODE_CAVE = 0x500,
.FUN_PRINTF = (0xFFFFFFFF804A7BD8 - KERNEL_TEXT),
// .FUN_HV_IOMMU_SET_BUFFERS not needed
// .FUN_HV_IOMM_WAIT_COMPLETION not needed
.FUN_SMP_RENDEZVOUS = (0xFFFFFFFF80CAC830 - KERNEL_TEXT),
.FUN_SMP_NO_RENDEVOUS_BARRIER = (0xFFFFFFFF804B3408 - KERNEL_TEXT),
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x6282DFEB,
.KERNEL_UART_OVERRIDE = (0xFFFFFFFF82291488 - KERNEL_TEXT),
.KERNEL_CFI_CHECK = (0xFFFFFFFF80678060 - KERNEL_TEXT),
.G_VBIOS = (0xFFFFFFFF87673A50 - KERNEL_TEXT),
.FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DA1BD0 - KERNEL_TEXT),
.FUN_MP3_INITIALIZE = (0xFFFFFFFF80BC1480 - KERNEL_TEXT),
.FUN_MP3_INVOKE = (0xFFFFFFFF80BC01A0 - KERNEL_TEXT),
.PS5_WIFI_FW_OFFSET = (0xFFFFFFFF8163EB30 - KERNEL_TEXT),
.PS5_WIFI_FW_SIZE = 493532,
};
offset_list off_0600 = {
// .IOMMU_SOFTC not needed
// .VMSPACE_VM_VMID not needed
.VMSPACE_VM_PMAP = 0x1D8,
// .DATA_BASE_GVMSPACE not needed
.ACPIGBL_FACS = (0xFFFFFFFF83C04540 - KERNEL_TEXT),
.IDT = (0xFFFFFFFF873CDDE0 - KERNEL_TEXT),
.COMMON_TSS = (0xFFFFFFFF873D0A00 - KERNEL_TEXT),
.STOPPED_CPUS = (0xFFFFFFFF87520DE0 - KERNEL_TEXT),
.FUN_STOP_CPUS = (0xFFFFFFFF80CD13B0 - KERNEL_TEXT),
.FUN_AS_LAPIC_EOI = (0xFFFFFFFF80451E60 - KERNEL_TEXT),
.FUN_HV_UNMAP_PT_TMR = (0xFFFFFFFF80DD36B0 - KERNEL_TEXT),
.FUN_MEMCPY = (0xFFFFFFFF804935B0 - KERNEL_TEXT),
.GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80bb6ad4 - KERNEL_TEXT),
.GAD_IRETQ = (0xFFFFFFFF804547ED - KERNEL_TEXT),
.GAD_POP_RDI_RET = (0xffffffff803f1ef8 - KERNEL_TEXT),
.GAD_POP_RSI_RET = (0xffffffff803b2a30 - KERNEL_TEXT),
.GAD_POP_RDX_RET = (0xffffffff803f321e - KERNEL_TEXT),
.GAD_POP_RSP_RET = (0xffffffff8045a830 - KERNEL_TEXT),
.GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff806141fa - KERNEL_TEXT),
// .HOOK_ACPI_WAKEUP_MACHDEP not needed
.KERNEL_CODE_CAVE = 0x500,
.FUN_PRINTF = (0xFFFFFFFF804B1460 - KERNEL_TEXT),
// .FUN_HV_IOMMU_SET_BUFFERS not needed
// .FUN_HV_IOMM_WAIT_COMPLETION not needed
.FUN_SMP_RENDEZVOUS = (0xFFFFFFFF80CD1990 - KERNEL_TEXT),
.FUN_SMP_NO_RENDEVOUS_BARRIER = (0xFFFFFFFF804BD118 - KERNEL_TEXT),
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x62841CE0,
.KERNEL_UART_OVERRIDE = (0xFFFFFFFF822D25C8 - KERNEL_TEXT),
.KERNEL_CFI_CHECK = (0xFFFFFFFF806899B0 - KERNEL_TEXT),
.G_VBIOS = (0xFFFFFFFF875DFA50 - KERNEL_TEXT),
.FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DCB210 - KERNEL_TEXT),
.FUN_MP3_INITIALIZE = (0xFFFFFFFF80BE3A40 - KERNEL_TEXT),
.FUN_MP3_INVOKE = (0xFFFFFFFF80BE27C0 - KERNEL_TEXT),
.PS5_WIFI_FW_OFFSET = (0xFFFFFFFF81665C00 - KERNEL_TEXT),
.PS5_WIFI_FW_SIZE = 494536,
};
offset_list off_0602 = {
// .IOMMU_SOFTC not needed
// .VMSPACE_VM_VMID not needed
.VMSPACE_VM_PMAP = 0x1D8,
// .DATA_BASE_GVMSPACE not needed
.ACPIGBL_FACS = (0xFFFFFFFF83C04540 - KERNEL_TEXT),
.IDT = (0xFFFFFFFF873CDDE0 - KERNEL_TEXT),
.COMMON_TSS = (0xFFFFFFFF873D0A00 - KERNEL_TEXT),
.STOPPED_CPUS = (0xFFFFFFFF87520DE0 - KERNEL_TEXT),
.FUN_STOP_CPUS = (0xFFFFFFFF80CD1390 - KERNEL_TEXT),
.FUN_AS_LAPIC_EOI = (0xFFFFFFFF80451E60 - KERNEL_TEXT),
.FUN_HV_UNMAP_PT_TMR = (0xFFFFFFFF80DD3690 - KERNEL_TEXT),
.FUN_MEMCPY = (0xFFFFFFFF804935B0 - KERNEL_TEXT),
.GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80bb6ab4 - KERNEL_TEXT),
.GAD_IRETQ = (0xFFFFFFFF804547ED - KERNEL_TEXT),
.GAD_POP_RDI_RET = (0xffffffff803f1ef8 - KERNEL_TEXT),
.GAD_POP_RSI_RET = (0xffffffff803b2a30 - KERNEL_TEXT),
.GAD_POP_RDX_RET = (0xffffffff804c48da - KERNEL_TEXT),
.GAD_POP_RSP_RET = (0xffffffff8045a830 - KERNEL_TEXT),
.GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff806141fa - KERNEL_TEXT),
// .HOOK_ACPI_WAKEUP_MACHDEP not needed
.KERNEL_CODE_CAVE = 0x500,
.FUN_PRINTF = (0xFFFFFFFF804B0C38 - KERNEL_TEXT),
// .FUN_HV_IOMMU_SET_BUFFERS not needed
// .FUN_HV_IOMM_WAIT_COMPLETION not needed
.FUN_SMP_RENDEZVOUS = (0xFFFFFFFF80CD1970 - KERNEL_TEXT),
.FUN_SMP_NO_RENDEVOUS_BARRIER = (0xFFFFFFFF804C05A8 - KERNEL_TEXT),
.HV_CODE_CAVE_PA = 0x62806F00,
.HV_HANDLE_VMEXIT_PA = 0x62841CE0,
.KERNEL_UART_OVERRIDE = (0xFFFFFFFF822D25C8 - KERNEL_TEXT),
.KERNEL_CFI_CHECK = (0xFFFFFFFF806899B0 - KERNEL_TEXT),
.G_VBIOS = (0xFFFFFFFF875DFA50 - KERNEL_TEXT),
.FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DCB1F0 - KERNEL_TEXT),
.FUN_MP3_INITIALIZE = (0xFFFFFFFF80BE3A20 - KERNEL_TEXT),
.FUN_MP3_INVOKE = (0xFFFFFFFF80BE27A0 - KERNEL_TEXT),
.PS5_WIFI_FW_OFFSET = (0xFFFFFFFF81665CC0 - KERNEL_TEXT),
.PS5_WIFI_FW_SIZE = 494536,
};