Add 7.40 support (#32)

* Update README.md

7.40 Support

* Update README.md

add 7.40 support

* Update offsets.h

add 7.40 support

* Update utils.c

add 7.40 support

* Update offsets.c

add 7.40 support

.gitignore

@@ -1,4 +1,5 @@
 bin/
+shellcode_0607/shellcode_0607.h
 shellcode_kernel/shellcode_kernel.h
 shellcode_hv/shellcode_hv.h
 *.elf

Makefile

@@ -13,10 +13,14 @@ OBJS := $(SRC:.c=.o)
 CFLAGS  := -std=c23 -Wall -Iinclude -Ishellcode_hv -Ishellcode_kernel
 LDFLAGS :=
 
+SC_0607_H := shellcode_0607/shellcode_0607.h
 SC_HV_H := shellcode_hv/shellcode_hv.h
 SC_K_H  := shellcode_kernel/shellcode_kernel.h
 
-all: $(SC_HV_H) $(SC_K_H) $(BIN)
+all: $(SC_0607_H) $(SC_HV_H) $(SC_K_H) $(BIN)
+
+$(SC_0607_H):
+	$(MAKE) -C shellcode_0607
 
 $(SC_HV_H):
 	$(MAKE) -C shellcode_hv
@@ -33,5 +37,6 @@ $(BIN): $(OBJS)
 
 clean:
 	rm -f $(BIN) $(OBJS)
+	$(MAKE) -C shellcode_0607 clean
 	$(MAKE) -C shellcode_hv clean
 	$(MAKE) -C shellcode_kernel clean

README.md

@@ -1,29 +1,39 @@
 # ps5-linux
 
-**ps5-linux** leverages a patched HV vulnerability to transform your PS5 Phat console running **3.00-6.02 firmwares** into a highly capable Linux PC, unlocking its full hardware potential for desktop use. Powered by 8 CPU cores (16 threads) at **3.5 GHz** and a GPU at **2.23 GHz**, it provides enough performance to run Steam games and various emulators with impressive fluidity. It supports HDMI 4K60 video and audio output. Furthermore, it allows you to utilize an **M.2 SSD** as a dedicated Linux partition, as well as all USB ports on the console.
+**ps5-linux** leverages patched HV vulnerabilities to transform your **PS5 Phat and Slim** console running **3.00-7.61 firmwares** into a highly capable Linux PC, unlocking its full hardware potential for desktop use. Powered by 8 CPU cores (16 threads) at **3.5 GHz** and a GPU at **2.23 GHz**, it provides enough performance to run Steam games and various emulators with impressive fluidity.
+
+Features:
+
+- HDMI 4K60 video and audio output
+- M.2 SSD as dedicated Linux partition
+- All USB ports usable for peripherals
+- BD drive usable via custom ahci driver
+- Internal Bluetooth usable via custom xhci driver
+- Ethernet port usable via custom gbe driver
 
 ![Alt Text](logo.webp)
 
 ## PS5 firmware
 
-*ps5-linux* is currently only supported on PS5 Phat on the following firmwares:
+*ps5-linux* is only supported on PS5 Phat and Slim on the following firmwares:
 
 - **3.00**, **3.10**, **3.20**, **3.21** without M.2 support
 - **4.00**, **4.02**, **4.03**, **4.50**, **4.51** with M.2 support
 - **5.00**, **5.02**, **5.10**, **5.50** with M.2 support
-- **6.00**, **6.02** with M.2 support
+- **6.00**, **6.02**, **6.50** with M.2 support
+- **7.20**, **7.40**, **7.61** with M.2 support
 
 Support for 1.xx and 2.xx firmwares may be added in the future, but we will not prioritize this effort.
 
-If you want to update to a specific firmware, [download the correct PUP](https://darthsternie.net/ps5-firmwares/) and follow the [official guide](https://www.playstation.com/en-us/support/hardware/reinstall-playstation-system-software-safe-mode) to upgrade your PS5. Obviously you cannot downgrade.
+If you are on firmwares in-between or you want to update to a specific firmware, [download the correct PUP](https://darthsternie.net/ps5-firmwares/) and follow the [official guide](https://www.playstation.com/en-us/support/hardware/reinstall-playstation-system-software-safe-mode) to upgrade your PS5. **Obviously you cannot downgrade.**
 
 ## Hardwares
 
 To run *ps5-linux*, you need some required and optional hardwares:
 
 - **Required**: USB drive with minimum 64GB (ideally external SSD) to install and run Linux.
-- **Required**: USB Ethernet/WLAN adapter for internet access.
 - **Required**: USB keyboard/mouse (dongles supported too).
+- *Optional*: USB WLAN adapter for WLAN internet access.
 - *Optional*: M.2 SSD compatible on PS5 (see [official guide](https://www.playstation.com/en-us/support/hardware/ps5-install-m2-ssd)) to run Linux from SSD.
 - *Optional*: Bluetooth dongle to connect with PS5 DualSense controller.
 
@@ -47,9 +57,15 @@ If you reset your PS5 settings or reinstall the FW, you need to reapply these se
 
 #### Pre-built images
 
-You can download them from [ps5-linux-image](https://github.com/ps5-linux/ps5-linux-image/releases/tag/latest). Recommended is `ps5-ubuntu2604.img.xz`.
+You can download them from [ps5-linux-image](https://github.com/ps5-linux/ps5-linux-image/releases/tag/latest). Recommended is `ps5-ubuntu2604.img.xz`. Unpack the `.xz` file.
 
-#### Linux/macOS:
+#### Build your own image
+
+If you use Windows,  run this in PowerShell or CMD as administrator to install WSL
+
+```bash
+wsl --install
+```
 
 Install docker:
 
@@ -60,38 +76,6 @@ sudo service docker start
 sudo usermod -aG docker $USER
 ```
 
-Restart the terminal.
-
-```bash
-git clone https://github.com/ps5-linux/ps5-linux-image
-cd ps5-linux-image
-chmod +x ./build_image.sh
-./build_image.sh --distro ubuntu2604
-```
-
-#### Windows (WSL2):
-
-If WSL2 is not installed yet, run this in PowerShell or CMD as administrator, then restart:
-
-```bash
-wsl --install
-```
-
-Then open WSL and set up Docker:
-
-```bash
-sudo apt update
-sudo apt install docker.io -y
-sudo service docker start
-sudo usermod -aG docker $USER
-```
-
-Restart WSL from PowerShell/CMD:
-
-```bash
-wsl --shutdown
-```
-
 Then clone and build:
 
 ```bash
@@ -138,7 +122,7 @@ The front top Type-A port is USB 2.0 which is slower and thus not recommended.
 5. Go into PS5 advanced network settings and set primary DNS to your PCs IP address and leave secondary at `0.0.0.0`
 6. Go to user manual in settings and accept untrusted certificate prompt, run.
 
-#### Firmware 6.00-6.02
+#### Firmware 6.00-7.61
 
 1. Install Y2JB by following https://github.com/Gezine/Y2JB.
 2. Run kernel exploit: `python3 payload_sender.py $PS5IP 50000 payloads/lapse.js`
@@ -164,11 +148,12 @@ Send the payload with your `$PS5IP` (shown on the page):
 socat -t 99999999 - TCP:$PS5IP:9021 < ps5-linux-loader.elf
 ```
 
-If all is successful, the payload will automatically go into rest mode. Wait until the orange LED stops blinking and becomes static. Only then, press the power button again to boot your PS5 into Linux. If the boot is successful, **the LED should turn white**. If it boots back into PS5 OS, then it's because you pressed the power button too early. Or, you did not enable rest mode features as described above.
+If all is successful, the payload will automatically go into rest mode. Wait until the orange LED stops blinking and becomes static. Only then, press the power button again to boot your PS5 into Linux. If the boot is successful, **the LED should turn white**. If it boots back into PS5 OS, then it's because you pressed the power button too early. Or, you did not enable rest mode features as described above. If it freezes instead of going into rest mode, then it is likely because you have etahen/kstuff enabled, which is incompatible. Disable them.
 
 If the LED is white, but you still have a blackscreen then:
 
 - Try removing `video=DP-1:1920x1080@60` line in cmdline.txt.
+- Try setting HDCP on or off (try both).
 - Try different monitors or capture cards, ideally with different resolutions. Currently, some monitors have issues.
 - Try setting `amdgpu.force_1080p=1` in `cmdline.txt` in the FAT32 partition of the USB drive.
 
@@ -214,7 +199,7 @@ Then, there are certain settings and commands we recommend doing:
    make
    ```
 
-7. Install the mwifiex driver for the internal WLAN chip:
+7. If you have a Marvell WLAN chip (`lspci -nn` shows `40:00.7 Ethernet controller [0200]: Marvell Technology Group Ltd. Device [1b4b:2b56] (rev 02)`), then you can install the WLAN driver:
 
    ```bash
    git clone https://github.com/ps5-linux/ps5-linux-mwifiex
@@ -275,7 +260,7 @@ For any future ps5-linux updates, you can download the `.deb` or `.pkg.tar.zst`
 
 ## FAQ
 
-- Q: Will higher >=6.50 firmwares be supported?
+- Q: Will higher >=8.00 firmwares be supported?
   - A: No.
 - Q: Why can I not use M.2 on 3.xx?
   - A: Because the PS5 fails to boot with it attached.
@@ -286,9 +271,9 @@ For any future ps5-linux updates, you can download the `.deb` or `.pkg.tar.zst`
 - Q: Can I continue using my PS5 if I install Linux?
   - A: Yes, the internal SSD is not modified
 - Q: Can I use the PS5's NIC/WLAN module in Linux?
-  - A: In theory yes, but someone needs to write or adapt drivers to use them.
+  - A: WLAN is only supported for Marvell chipsets at the moment. Ethernet is supported on all models.
 - Q: Does the DualSense controller work?
-  - A: Via a Bluetooth dongle. Built-in Bluetooth is not yet supported.
+  - A: Yes, via internal Bluetooth as well as Bluetooth dongle.
 - Q: What resolutions and refresh rates are supported?
   - A: 1080p, 1440p and 2160p at 60Hz are broadly supported. 1440p@120Hz has been the only confirmed working on the DELL S3225QC yet. 120Hz or 30Hz may be added in the future.
 - Q: After reboot, I get a "Repairing" screen and "Your PS5 wasn't turned off properly." screen. Is that normal?
@@ -328,8 +313,9 @@ Join our [Discord server](https://discord.gg/PeMGVB7BAm) to celebrate Linux on P
 - [theflow](https://github.com/TheOfficialFloW): [ps5-linux-loader](https://github.com/ps5-linux/ps5-linux-loader), [ps5-linux-patches](https://github.com/ps5-linux/ps5-linux-patches), [ps5-linux-tools](https://github.com/ps5-linux/ps5-linux-tools)
 - [c0w](https://github.com/c0w-ar): [ps5-linux-loader](https://github.com/ps5-linux/ps5-linux-loader)
 - [resulknad](https://github.com/resulknad): [ps5-linux-image](https://github.com/ps5-linux/ps5-linux-image)
+- [rmuxnet](https://github.com/rmuxnet): [ps5 ethernet driver](https://github.com/ps5-linux/ps5-linux-patches/commit/643e214d7bd37f292045fc0dbb821e421f7a3e47)
 - [fail0verflow](https://github.com/fail0verflow): [prosperous](https://github.com/fail0verflow/prosperous)
-- [flatz](github.com/flatz): [HV exploit](https://gist.github.com/flatz/620ddda6d64acca6d1c990dc3080ac0e)
+- [flatz](https://github.com/flatz): [HV exploit](https://gist.github.com/flatz/620ddda6d64acca6d1c990dc3080ac0e)
 - [cragson](https://github.com/cragson): [HV expoit implementation](https://github.com/cragson/ps5-hen)
 - [john-tornblom](https://github.com/john-tornblom): [PS5 SDK](https://github.com/ps5-payload-dev/sdk)
 - [echostretch](https://github.com/echostretch): Offsets and testing

include/config.h

@@ -20,7 +20,8 @@
 // This is used as transitional storage from ProsperoOS to Kernel shellcode
 #define kernel_cave 0xFFFF800000000000
 #define kernel_cave_shellcode kernel_cave
-#define kernel_cave_files kernel_cave_shellcode + PAGE_SIZE + PAGE_SIZE
+#define kernel_cave_shellcode_0761 kernel_cave_shellcode + PAGE_SIZE + PAGE_SIZE
+#define kernel_cave_files kernel_cave_shellcode_0761 + PAGE_SIZE
 #define kernel_cave_linux_info kernel_cave_files
 #define kernel_cave_bzImage kernel_cave_linux_info + PAGE_SIZE
 

include/hv_defeat_0607.h

@@ -0,0 +1,8 @@
+#ifndef HV_DEFEAT_0607_H
+#define HV_DEFEAT_0607_H
+
+#include <stddef.h>
+
+int hv_defeat_0607(void *shellcode_kernel, size_t shellcode_kernel_len);
+
+#endif

include/offsets.h

@@ -20,10 +20,13 @@ typedef struct _offset_list {
   uint64_t FUN_MEMCPY;
   uint64_t GAD_ADD_RSP_28_POP_RBP_RET;
   uint64_t GAD_IRETQ;
+  uint64_t GAD_POP_RAX_RET;
   uint64_t GAD_POP_RDI_RET;
   uint64_t GAD_POP_RSI_RET;
   uint64_t GAD_POP_RDX_RET;
+  uint64_t GAD_POP_RCX_RET;
   uint64_t GAD_POP_RSP_RET;
+  uint64_t GAD_WRMSR_RET;
   uint64_t GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET;
   /* Shellcode Kernel */
   uint64_t HOOK_ACPI_WAKEUP_MACHDEP;
@@ -64,5 +67,9 @@ extern offset_list off_0510;
 extern offset_list off_0550;
 extern offset_list off_0600;
 extern offset_list off_0602;
+extern offset_list off_0650;
+extern offset_list off_0720;
+extern offset_list off_0740;
+extern offset_list off_0761;
 
 #endif

shellcode_0607/Makefile

@@ -0,0 +1,34 @@
+ifeq ($(shell uname -m),aarch64)
+CC      = x86_64-linux-gnu-gcc
+LD      = x86_64-linux-gnu-ld
+OBJCOPY = x86_64-linux-gnu-objcopy
+else
+CC      = gcc
+LD      = ld
+OBJCOPY = objcopy
+endif
+CFLAGS  = -O2 -fno-stack-protector -ffreestanding -nostdlib -fcf-protection=none -mno-sse -mno-sse2 -m64
+LDFLAGS = -T linker.ld -Wl,--no-warn-rwx-segments
+TARGET  = shellcode_0607.elf
+TEXT_BIN = shellcode_0607.bin
+dump = shellcode_0607.h
+
+SRC = main.c utils.c
+OBJ = $(SRC:.c=.o)
+
+all: $(dump)
+
+$(TARGET): $(OBJ)
+	$(CC) $(CFLAGS) $(LDFLAGS) $(OBJ) -o $(TARGET)
+
+%.o: %.c
+	$(CC) $(CFLAGS) -c $< -o $@
+
+$(TEXT_BIN): $(TARGET)
+	$(OBJCOPY) -O binary -j .shell_code $(TARGET) $(TEXT_BIN)
+
+clean:
+	rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump)
+
+$(dump): $(TEXT_BIN)
+	xxd -i $(TEXT_BIN) > $(dump)

shellcode_0607/linker.ld

@@ -0,0 +1,18 @@
+/* linker.ld */
+ENTRY(main)
+
+SECTIONS
+{
+    . = 0x1000; /* 0x1000 to avoid warnings from linker */
+    /* Place our custom header first */
+    .shell_code :
+    {
+        *(.entry_point)
+        *(.text)
+        *(.text.*)
+        *(.data*)
+        *(.rodata*)
+        *(.bss)
+        *(.bss.*)
+    }
+}

shellcode_0607/main.c

@@ -0,0 +1,71 @@
+#include "utils.h"
+
+// 7.xx offsets
+#define HV_REENTER_HYPERCORE_07xx 0x0000000062806380ULL
+#define HV_STACK_TABLE_07xx 0x000000006282E120ULL
+#define HV_PML4_07xx 0x000000006282E1A0ULL
+#define HV_ENTRY_07xx 0x000000006282E1B8ULL
+#define HV_MAIN_07xx 0x0000000000000E20
+#define G_VM_TAB_07xx 0x0000000000027C80
+
+// 6.50 offsets
+#define HV_REENTER_HYPERCORE_0650 0x0000000062806780ULL
+#define HV_STACK_TABLE_0650 0x000000006282D0C0ULL
+#define HV_PML4_0650 0x000000006282D140ULL
+#define HV_ENTRY_0650 0x000000006282D158ULL
+#define HV_MAIN_0650 0x0000000000000F10
+#define G_VM_TAB_0650 0x0000000000023C80
+
+#define MSR_APICBASE 0x01b
+#define MSR_GSBASE 0xc0000101
+
+#define DEFAULT_APIC_BASE 0xfee00000
+
+#define APICBASE_ENABLED 0x00000800
+#define APICBASE_BSP 0x00000100
+
+#define NESTED_CTRL_NP_ENABLE 0x1
+
+__attribute__((section(".entry_point"), naked)) uint32_t main(void) {
+  volatile int fw_version = 0x11AA11AA; // To be updated by loader
+
+  uint64_t hv_pml4 =
+      *(uint64_t *)(fw_version == 0x0650 ? HV_PML4_0650 : HV_PML4_07xx);
+  uint64_t hv_base = fw_version == 0x0650
+                         ? (*(uint64_t *)HV_ENTRY_0650 - HV_MAIN_0650)
+                         : (*(uint64_t *)HV_ENTRY_07xx - HV_MAIN_07xx);
+
+  uintptr_t *g_vm_tab = (uintptr_t *)vtophys_custom(
+      hv_base + (fw_version == 0x0650 ? G_VM_TAB_0650 : G_VM_TAB_07xx),
+      hv_pml4);
+  for (int i = 0; i < 16; i++) {
+    uintptr_t vc = vtophys_custom(g_vm_tab[i], hv_pml4);
+    uintptr_t vmcb = vtophys_custom(*(uintptr_t *)(vc + 0x08), hv_pml4);
+
+    if (i == 0) {
+      // Restore guest_apic_base.
+      *(uint64_t *)(vc + 0xe8) =
+          DEFAULT_APIC_BASE | APICBASE_ENABLED | APICBASE_BSP;
+    }
+
+    // Disable nested paging.
+    *(uint64_t *)(vmcb + 0x90) &= ~NESTED_CTRL_NP_ENABLE;
+  }
+
+  // Restore host apic base.
+  wrmsr(MSR_APICBASE, DEFAULT_APIC_BASE | APICBASE_ENABLED | APICBASE_BSP);
+
+  // Restore gs base.
+  wrmsr(MSR_GSBASE,
+        ((uint64_t *)(fw_version == 0x0650 ? HV_STACK_TABLE_0650
+                                           : HV_STACK_TABLE_07xx))[0] +
+            0x1000);
+
+  // Reenter hypercore.
+  void (*hv_reenter_hypercore)(void) =
+      (void *)(fw_version == 0x0650 ? HV_REENTER_HYPERCORE_0650
+                                    : HV_REENTER_HYPERCORE_07xx);
+  hv_reenter_hypercore();
+  while (1)
+    ;
+}

shellcode_0607/utils.c

@@ -0,0 +1,35 @@
+#include "utils.h"
+#include <cpuid.h>
+
+uint64_t vtophys_custom(uint64_t va, uint64_t cr3_custom) {
+  uint64_t table_phys = cr3_custom & 0xFFFFFFFF;
+
+  for (int level = 0; level < 4; level++) {
+    int shift = 39 - (level * 9);
+    uint64_t idx = (va >> shift) & 0x1FF;
+    uint64_t entry;
+    uint64_t entry_va = PAGE_PA(table_phys) + idx * 8;
+
+    entry = *(uint64_t *)entry_va;
+
+    if (!PAGE_P(entry))
+      return 0;
+
+    if ((level == 1 || level == 2) && PAGE_PS(entry)) {
+      uint64_t page_size = P_SIZE(level);
+      return PAGE_PA(entry) | (va & (page_size - 1));
+    }
+
+    if (level == 3)
+      return PAGE_PA(entry) | (va & 0xFFF);
+
+    table_phys = PAGE_PA(entry);
+  }
+  return 0;
+}
+
+void wrmsr(uint32_t msr, uint64_t val) {
+  uint32_t low = val & 0xFFFFFFFF;
+  uint32_t high = val >> 32;
+  __asm__ __volatile__("wrmsr" : : "a"(low), "d"(high), "c"(msr));
+}

shellcode_0607/utils.h

@@ -0,0 +1,37 @@
+#ifndef UTILS_H
+#define UTILS_H
+
+#include <stdint.h>
+
+// Defines for Page management
+enum page_bits {
+  P = 0,
+  RW,
+  US,
+  PWT,
+  PCD,
+  A,
+  D,
+  PS,
+  G,
+  XO = 58,
+  PK = 59,
+  NX = 63
+};
+
+#define PG_B_P (1ULL << P)
+#define PG_B_RW (1ULL << RW)
+#define PAGE_P(x) (x & (1ULL << P))
+#define PAGE_RW(x) (x & (1ULL << RW))
+#define PAGE_PS(x) (x & (1ULL << PS))
+#define PAGE_XO(x) (x & (1ULL << XO))
+#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO))
+#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G))
+#define PAGE_SET_RW(x) (x |= (1ULL << RW))
+#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL)
+#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21))
+
+uint64_t vtophys_custom(uint64_t va, uint64_t cr3_custom);
+void wrmsr(uint32_t msr, uint64_t val);
+
+#endif

shellcode_kernel/boot_linux.c

@@ -79,7 +79,7 @@ static inline uint64_t vmmcall(uint64_t nr, uint64_t a0, uint64_t a1,
 static uint64_t get_hv_shm(void) {
   if (args.fw_version >= 0x0500 && args.fw_version < 0x0600) {
     return 0x62a01000;
-  } else if (args.fw_version >= 0x0600 && args.fw_version < 0x0650) {
+  } else if (args.fw_version >= 0x0600 && args.fw_version < 0x0800) {
     return 0x62a22000;
   }
   return -1;
@@ -188,7 +188,7 @@ void boot_linux(void) {
   memcpy(&info, (void *)args.linux_info_va, sizeof(struct linux_info));
 
   info.n_tmrs = 0;
-  if (args.fw_version >= 0x0500 && args.fw_version < 0x0650) {
+  if (args.fw_version >= 0x0500 && args.fw_version < 0x0800) {
     SceSblHvShm *shm = (SceSblHvShm *)PHYS_TO_DMAP(get_hv_shm());
 
     for (int i = 0; i < 64; i++) {

shellcode_kernel/main.c

@@ -28,7 +28,7 @@ __attribute__((section(".entry_point"))) uint32_t main(uint64_t add1,
     if (hv_defeat_0304(args_ptr))
       return -1;
   } else if ((0x0500 <= args_ptr->fw_version) &&
-             (args_ptr->fw_version < 0x0650)) {
+             (args_ptr->fw_version < 0x0800)) {
     // Already escaped.
   } else {
     return 0;

source/hv_defeat_0607.c

@@ -0,0 +1,143 @@
+#include "hv_defeat_0607.h"
+#include "../shellcode_0607/shellcode_0607.h"
+#include "config.h"
+#include "utils.h"
+#include <machine/segments.h>
+#include <machine/tss.h>
+#include <stdio.h>
+#include <sys/mman.h>
+
+#define IDT_SX 30
+
+#define MSR_APICBASE 0x01b
+
+#define APICBASE_ENABLED 0x00000800
+#define APICBASE_BSP 0x00000100
+
+static void setidt(int idx, uintptr_t func, int typ, int dpl, int ist) {
+  struct gate_descriptor ip = {};
+  ip.gd_looffset = func;
+  ip.gd_selector = GSEL(GCODE_SEL, SEL_KPL);
+  ip.gd_ist = ist;
+  ip.gd_xx = 0;
+  ip.gd_type = typ;
+  ip.gd_dpl = dpl;
+  ip.gd_p = 1;
+  ip.gd_hioffset = func >> 16;
+  kwrite(ktext + env_offset.IDT + idx * sizeof(struct gate_descriptor), &ip,
+         sizeof(ip));
+}
+
+static uint64_t get_hv_stack(void) {
+  if (fw >= 0x0720 && fw < 0x0800) {
+    return 0x628ec000;
+  }
+  if (fw == 0x0650) {
+    return 0x628d0000;
+  }
+  return -1;
+}
+
+static void build_gp_rop(uintptr_t ist) {
+  uint64_t rop_buf[256] = {};
+  uint64_t *rop = rop_buf;
+
+  // Copy shellcode_0607 to pa 0.
+  *rop++ = ktext + env_offset.GAD_POP_RDI_RET;
+  *rop++ = pa_to_dmap(0);
+  *rop++ = ktext + env_offset.GAD_POP_RSI_RET;
+  *rop++ = kernel_cave_shellcode_0761;
+  *rop++ = ktext + env_offset.GAD_POP_RDX_RET;
+  *rop++ = shellcode_0607_bin_len;
+  *rop++ = ktext + env_offset.FUN_MEMCPY;
+
+  // wrmsr(MSR_APICBASE, get_hv_stack() | APICBASE_ENABLED | APICBASE_BSP);
+  uint64_t index = MSR_APICBASE;
+  uint64_t value = get_hv_stack() | APICBASE_ENABLED | APICBASE_BSP;
+  *rop++ = ktext + env_offset.GAD_POP_RCX_RET;
+  *rop++ = index;
+  *rop++ = ktext + env_offset.GAD_POP_RAX_RET;
+  *rop++ = value & 0xffffffff;
+  *rop++ = ktext + env_offset.GAD_POP_RDX_RET;
+  *rop++ = value >> 32;
+  *rop++ = ktext + env_offset.GAD_WRMSR_RET;
+
+  // Trigger hv code execution.
+  *rop++ = ktext + env_offset.GAD_WRMSR_RET;
+
+  kwrite(ist + 0x1000, rop_buf, (uintptr_t)rop - (uintptr_t)rop_buf);
+}
+
+static void build_sx_rop(uintptr_t ist, size_t shellcode_kernel_len) {
+  uint64_t rop_buf[256] = {};
+  uint64_t *rop = rop_buf;
+
+  // Copy shellcode.
+  *rop++ = ktext + env_offset.GAD_POP_RDI_RET;
+  *rop++ = ktext + env_offset.KERNEL_CODE_CAVE;
+  *rop++ = ktext + env_offset.GAD_POP_RSI_RET;
+  *rop++ = kernel_cave_shellcode;
+  *rop++ = ktext + env_offset.GAD_POP_RDX_RET;
+  *rop++ = shellcode_kernel_len;
+  *rop++ = ktext + env_offset.FUN_MEMCPY;
+
+  // Jump to shellcode.
+  *rop++ = ktext + env_offset.KERNEL_CODE_CAVE;
+
+  kwrite(ist + 0x1000, rop_buf, (uintptr_t)rop - (uintptr_t)rop_buf);
+}
+
+static int update_sc_fw_version(uint64_t shellcode) {
+  // Find the address 0x11AA11AA used as marker
+  int offset = -1;
+  for (uint64_t i = 0; i < 0x40; i++) {
+    if (*(uint32_t *)(shellcode + i) == 0x11AA11AA) {
+      offset = i;
+      break;
+    }
+  }
+  if (offset == -1) {
+    notify("Could not find offset of shellcode fw version - Aborting\n");
+    return -1;
+  }
+  *(uint32_t *)(shellcode + offset) = fw;
+  return 0;
+}
+
+int hv_defeat_0607(void *shellcode_kernel, size_t shellcode_kernel_len) {
+  void *shellcode_0607 =
+      mmap(NULL, ALIGN_UP(shellcode_0607_bin_len, PAGE_SIZE),
+           PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+  memcpy(shellcode_0607, shellcode_0607_bin, shellcode_0607_bin_len);
+
+  if (update_sc_fw_version((uint64_t)shellcode_0607))
+    return -1;
+
+  for (int i = 0; i < shellcode_0607_bin_len; i += PAGE_SIZE) {
+    install_page_syscore(kernel_cave_shellcode_0761 + i,
+                         vtophys_user((uintptr_t)shellcode_0607 + i), 0);
+  }
+
+  uintptr_t ist_gp = pa_to_dmap(alloc_page());
+  build_gp_rop(ist_gp);
+  kwrite64(ktext + env_offset.COMMON_TSS + 0 * sizeof(struct amd64tss) +
+               offsetof(struct amd64tss, tss_ist6),
+           ist_gp + 0x1000);
+  setidt(IDT_GP, ktext + env_offset.GAD_ADD_RSP_28_POP_RBP_RET, SDT_SYSIGT,
+         SEL_KPL, 6);
+
+  uintptr_t ist_sx = pa_to_dmap(alloc_page());
+  build_sx_rop(ist_sx, shellcode_kernel_len);
+  kwrite64(ktext + env_offset.COMMON_TSS + 0 * sizeof(struct amd64tss) +
+               offsetof(struct amd64tss, tss_ist7),
+           ist_sx + 0x1000);
+  setidt(IDT_SX, ktext + env_offset.GAD_ADD_RSP_28_POP_RBP_RET, SDT_SYSIGT,
+         SEL_KPL, 7);
+
+  // During suspend, AcpiSetFirmwareWakingVector will corrupt its own pointer,
+  // and during resume it will trigger #GP, thus executing our ROP chain.
+  kwrite64(ktext + env_offset.ACPIGBL_FACS,
+           ktext + env_offset.ACPIGBL_FACS - 8);
+
+  return 0;
+}

source/main.c

@@ -1,5 +1,6 @@
 #include "hv_defeat_0304.h"
 #include "hv_defeat_0506.h"
+#include "hv_defeat_0607.h"
 #include "loader.h"
 #include "prepare_resume.h"
 #include "utils.h"
@@ -30,6 +31,9 @@ int main(void) {
   } else if ((0x0500 <= fw) && (fw < 0x0650)) {
     if (hv_defeat_0506(shellcode_kernel, shellcode_kernel_len))
       goto err;
+  } else if ((0x0650 <= fw) && (fw < 0x0800)) {
+    if (hv_defeat_0607(shellcode_kernel, shellcode_kernel_len))
+      goto err;
   } else {
     goto err;
   }

source/offsets.c

@@ -233,9 +233,12 @@ offset_list off_0500 = {
     .FUN_MEMCPY = (0xFFFFFFFF80489E30 - KERNEL_TEXT),
     .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80b93d94 - KERNEL_TEXT),
     .GAD_IRETQ = (0xffffffff8044b06d - KERNEL_TEXT),
+    // .GAD_POP_RAX_RET not needed
     .GAD_POP_RDI_RET = (0xffffffff803e8778 - KERNEL_TEXT),
     .GAD_POP_RSI_RET = (0xffffffff803a92b0 - KERNEL_TEXT),
     .GAD_POP_RDX_RET = (0xffffffff8040dafc - KERNEL_TEXT),
+    // .GAD_POP_RCX_RET not needed
+    // .GAD_WRMSR_RET not needed
     .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff80603c0a - KERNEL_TEXT),
     // .HOOK_ACPI_WAKEUP_MACHDEP not needed
     .KERNEL_CODE_CAVE = 0x500,
@@ -271,9 +274,12 @@ offset_list off_0502 = {
     .FUN_MEMCPY = (0xFFFFFFFF80489E30 - KERNEL_TEXT),
     .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80b93d94 - KERNEL_TEXT),
     .GAD_IRETQ = (0xffffffff8044b06d - KERNEL_TEXT),
+    // .GAD_POP_RAX_RET not needed
     .GAD_POP_RDI_RET = (0xffffffff803e8778 - KERNEL_TEXT),
     .GAD_POP_RSI_RET = (0xffffffff803a92b0 - KERNEL_TEXT),
     .GAD_POP_RDX_RET = (0xffffffff8054d532 - KERNEL_TEXT),
+    // .GAD_POP_RCX_RET not needed
+    // .GAD_WRMSR_RET not needed
     .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff80603c0a - KERNEL_TEXT),
     // .HOOK_ACPI_WAKEUP_MACHDEP not needed
     .KERNEL_CODE_CAVE = 0x500,
@@ -309,9 +315,12 @@ offset_list off_0510 = {
     .FUN_MEMCPY = (0xFFFFFFFF80489E30 - KERNEL_TEXT),
     .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80b93fe4 - KERNEL_TEXT),
     .GAD_IRETQ = (0xffffffff8044b06d - KERNEL_TEXT),
+    // .GAD_POP_RAX_RET not needed
     .GAD_POP_RDI_RET = (0xffffffff803e8778 - KERNEL_TEXT),
     .GAD_POP_RSI_RET = (0xffffffff803a92b0 - KERNEL_TEXT),
     .GAD_POP_RDX_RET = (0xffffffff8054d532 - KERNEL_TEXT),
+    // .GAD_POP_RCX_RET not needed
+    // .GAD_WRMSR_RET not needed
     .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff80603c0a - KERNEL_TEXT),
     // .HOOK_ACPI_WAKEUP_MACHDEP not needed
     .KERNEL_CODE_CAVE = 0x500,
@@ -347,9 +356,12 @@ offset_list off_0550 = {
     .FUN_MEMCPY = (0xFFFFFFFF80489DF0 - KERNEL_TEXT),
     .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80b94dd4 - KERNEL_TEXT),
     .GAD_IRETQ = (0xFFFFFFFF8044B02D - KERNEL_TEXT),
+    // .GAD_POP_RAX_RET not needed
     .GAD_POP_RDI_RET = (0xffffffff803e8738 - KERNEL_TEXT),
     .GAD_POP_RSI_RET = (0xffffffff803a9270 - KERNEL_TEXT),
     .GAD_POP_RDX_RET = (0xffffffff8054d4f2 - KERNEL_TEXT),
+    // .GAD_POP_RCX_RET not needed
+    // .GAD_WRMSR_RET not needed
     .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff80603cba - KERNEL_TEXT),
     // .HOOK_ACPI_WAKEUP_MACHDEP not needed
     .KERNEL_CODE_CAVE = 0x500,
@@ -385,10 +397,13 @@ offset_list off_0600 = {
     .FUN_MEMCPY = (0xFFFFFFFF804935B0 - KERNEL_TEXT),
     .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80bb6ad4 - KERNEL_TEXT),
     .GAD_IRETQ = (0xFFFFFFFF804547ED - KERNEL_TEXT),
+    // .GAD_POP_RAX_RET not needed
     .GAD_POP_RDI_RET = (0xffffffff803f1ef8 - KERNEL_TEXT),
     .GAD_POP_RSI_RET = (0xffffffff803b2a30 - KERNEL_TEXT),
     .GAD_POP_RDX_RET = (0xffffffff803f321e - KERNEL_TEXT),
+    // .GAD_POP_RCX_RET not needed
     .GAD_POP_RSP_RET = (0xffffffff8045a830 - KERNEL_TEXT),
+    // .GAD_WRMSR_RET not needed
     .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff806141fa - KERNEL_TEXT),
     // .HOOK_ACPI_WAKEUP_MACHDEP not needed
     .KERNEL_CODE_CAVE = 0x500,
@@ -424,10 +439,13 @@ offset_list off_0602 = {
     .FUN_MEMCPY = (0xFFFFFFFF804935B0 - KERNEL_TEXT),
     .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80bb6ab4 - KERNEL_TEXT),
     .GAD_IRETQ = (0xFFFFFFFF804547ED - KERNEL_TEXT),
+    // .GAD_POP_RAX_RET not needed
     .GAD_POP_RDI_RET = (0xffffffff803f1ef8 - KERNEL_TEXT),
     .GAD_POP_RSI_RET = (0xffffffff803b2a30 - KERNEL_TEXT),
     .GAD_POP_RDX_RET = (0xffffffff804c48da - KERNEL_TEXT),
+    // .GAD_POP_RCX_RET not needed
     .GAD_POP_RSP_RET = (0xffffffff8045a830 - KERNEL_TEXT),
+    // .GAD_WRMSR_RET not needed
     .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff806141fa - KERNEL_TEXT),
     // .HOOK_ACPI_WAKEUP_MACHDEP not needed
     .KERNEL_CODE_CAVE = 0x500,
@@ -447,3 +465,173 @@ offset_list off_0602 = {
     .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF81665CC0 - KERNEL_TEXT),
     .PS5_WIFI_FW_SIZE = 494536,
 };
+
+offset_list off_0650 = {
+    // .IOMMU_SOFTC not needed
+    // .VMSPACE_VM_VMID not needed
+    .VMSPACE_VM_PMAP = 0x1D8,
+    // .DATA_BASE_GVMSPACE not needed
+    .ACPIGBL_FACS = (0xffffffff83c04540 - KERNEL_TEXT),
+    .IDT = (0xffffffff873cdde0 - KERNEL_TEXT),
+    .COMMON_TSS = (0xffffffff873d0a00 - KERNEL_TEXT),
+    // .STOPPED_CPUS not needed
+    // .FUN_STOP_CPUS not needed
+    // .FUN_AS_LAPIC_EOI not needed
+    // .FUN_HV_UNMAP_PT_TMR not needed
+    .FUN_MEMCPY = (0xffffffff804935b0 - KERNEL_TEXT),
+    .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80bb7224 - KERNEL_TEXT),
+    .GAD_IRETQ = (0xffffffff804547ed - KERNEL_TEXT),
+    .GAD_POP_RAX_RET = (0xffffffff8040eb50 - KERNEL_TEXT),
+    .GAD_POP_RDI_RET = (0xffffffff803f1ef8 - KERNEL_TEXT),
+    .GAD_POP_RSI_RET = (0xffffffff803b2a30 - KERNEL_TEXT),
+    .GAD_POP_RDX_RET = (0xffffffff80536a32 - KERNEL_TEXT),
+    //.GAD_POP_RCX_RET = (0xffffffff8033ba53 - KERNEL_TEXT),
+    .GAD_POP_RCX_RET = (0xffffffff804e68b8 - KERNEL_TEXT),
+    .GAD_POP_RSP_RET = (0xffffffff8045a830 - KERNEL_TEXT),
+    .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff8061421a - KERNEL_TEXT),
+    .GAD_WRMSR_RET = (0xffffffff80451e84 - KERNEL_TEXT),
+    // .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET not needed
+    // .HOOK_ACPI_WAKEUP_MACHDEP not needed
+    .KERNEL_CODE_CAVE = 0x500,
+    .FUN_PRINTF = (0xffffffff806d2610 - KERNEL_TEXT),
+    // .FUN_HV_IOMMU_SET_BUFFERS not needed
+    // .FUN_HV_IOMM_WAIT_COMPLETION not needed
+    .FUN_SMP_RENDEZVOUS = (0xffffffff80cd20e0 - KERNEL_TEXT),
+    .FUN_SMP_NO_RENDEVOUS_BARRIER = (0xffffffff804bc370 - KERNEL_TEXT),
+    .HV_CODE_CAVE_PA = 0x62806F00,
+    .HV_HANDLE_VMEXIT_PA = 0x62841D50,
+    .KERNEL_UART_OVERRIDE = (0xffffffff822d25c8 - KERNEL_TEXT),
+    .KERNEL_CFI_CHECK = (0xffffffff80689a20 - KERNEL_TEXT),
+    .G_VBIOS = (0xffffffff875dfa50 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xffffffff80dcb990 - KERNEL_TEXT),
+    .FUN_MP3_INITIALIZE = (0xffffffff80be4190 - KERNEL_TEXT),
+    .FUN_MP3_INVOKE = (0xffffffff80be2f10 - KERNEL_TEXT),
+    .PS5_WIFI_FW_OFFSET = (0xffffffff81665b90 - KERNEL_TEXT),
+    .PS5_WIFI_FW_SIZE = 494536,
+};
+
+offset_list off_0720 = {
+    // .IOMMU_SOFTC not needed
+    // .VMSPACE_VM_VMID not needed
+    .VMSPACE_VM_PMAP = 0x1D8,
+    // .DATA_BASE_GVMSPACE not needed
+    .ACPIGBL_FACS = (0xffffffff83ac9c50 - KERNEL_TEXT),
+    .IDT = (0xffffffff83cdfdf0 - KERNEL_TEXT),
+    .COMMON_TSS = (0xffffffff83ce2ad0 - KERNEL_TEXT),
+    // .STOPPED_CPUS not needed
+    // .FUN_STOP_CPUS not needed
+    // .FUN_AS_LAPIC_EOI not needed
+    // .FUN_HV_UNMAP_PT_TMR not needed
+    .FUN_MEMCPY = (0xffffffff80493600 - KERNEL_TEXT),
+    .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80c435ff - KERNEL_TEXT),
+    .GAD_IRETQ = (0xffffffff809c52e8 - KERNEL_TEXT),
+    .GAD_POP_RAX_RET = (0xffffffff80e4c2d5 - KERNEL_TEXT),
+    .GAD_POP_RDI_RET = (0xffffffff80dfe38b - KERNEL_TEXT),
+    .GAD_POP_RSI_RET = (0xffffffff80dfdd9e - KERNEL_TEXT),
+    .GAD_POP_RDX_RET = (0xffffffff80a4fd38 - KERNEL_TEXT),
+    .GAD_POP_RCX_RET = (0xffffffff80e24def - KERNEL_TEXT),
+    .GAD_POP_RSP_RET = (0xffffffff80e2b4c0 - KERNEL_TEXT),
+    .GAD_WRMSR_RET = (0xffffffff80451d04 - KERNEL_TEXT),
+    // .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET not needed
+    // .HOOK_ACPI_WAKEUP_MACHDEP not needed
+    .KERNEL_CODE_CAVE = 0x500,
+    .FUN_PRINTF = (0xffffffff806cc830 - KERNEL_TEXT),
+    // .FUN_HV_IOMMU_SET_BUFFERS not needed
+    // .FUN_HV_IOMM_WAIT_COMPLETION not needed
+    .FUN_SMP_RENDEZVOUS = (0xffffffff80cb6100 - KERNEL_TEXT),
+    .FUN_SMP_NO_RENDEVOUS_BARRIER = (0xffffffff804c0820 - KERNEL_TEXT),
+    .HV_CODE_CAVE_PA = 0x62806F00,
+    .HV_HANDLE_VMEXIT_PA = 0x6283D800,
+    .KERNEL_UART_OVERRIDE = (0xffffffff822c33f8 - KERNEL_TEXT),
+    .KERNEL_CFI_CHECK = (0xffffffff806857a0 - KERNEL_TEXT),
+    .G_VBIOS = (0xffffffff83ef7a40 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xffffffff80dafcc0 - KERNEL_TEXT),
+    .FUN_MP3_INITIALIZE = (0xffffffff80bcba10 - KERNEL_TEXT),
+    .FUN_MP3_INVOKE = (0xffffffff80bca7d0 - KERNEL_TEXT),
+    .PS5_WIFI_FW_OFFSET = (0xffffffff81655700 - KERNEL_TEXT),
+    .PS5_WIFI_FW_SIZE = 497636,
+};
+
+offset_list off_0740 = {
+    // .IOMMU_SOFTC not needed
+    // .VMSPACE_VM_VMID not needed
+    .VMSPACE_VM_PMAP = 0x1D8,
+    // .DATA_BASE_GVMSPACE not needed
+    .ACPIGBL_FACS = (0xFFFFFFFF83AC9C50 - KERNEL_TEXT),
+    .IDT = (0xFFFFFFFF83CDFDF0 - KERNEL_TEXT),
+    .COMMON_TSS = (0xFFFFFFFF83CE2AD0 - KERNEL_TEXT),
+    // .STOPPED_CPUS not needed
+    // .FUN_STOP_CPUS not needed
+    // .FUN_AS_LAPIC_EOI not needed
+    // .FUN_HV_UNMAP_PT_TMR not needed
+    .FUN_MEMCPY = (0xFFFFFFFF80493600 - KERNEL_TEXT),
+    .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80c435ff - KERNEL_TEXT),
+    .GAD_IRETQ = (0xffffffff8045480d - KERNEL_TEXT),
+    .GAD_POP_RAX_RET = (0xffffffff8040e9d0 - KERNEL_TEXT),
+    .GAD_POP_RDI_RET = (0xffffffff803f1d78 - KERNEL_TEXT),
+    .GAD_POP_RSI_RET = (0xffffffff803b28b0 - KERNEL_TEXT),
+    .GAD_POP_RDX_RET = (0xffffffff805cd53c - KERNEL_TEXT),
+    .GAD_POP_RCX_RET = (0xffffffff80e24def - KERNEL_TEXT),
+    .GAD_POP_RSP_RET = (0xffffffff8045a850 - KERNEL_TEXT),
+    .GAD_WRMSR_RET = (0xffffffff80451d04 - KERNEL_TEXT),
+    // .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET not needed
+    // .HOOK_ACPI_WAKEUP_MACHDEP not needed
+    .KERNEL_CODE_CAVE = 0x500,
+    .FUN_PRINTF = (0xffffffff804b19f0 - KERNEL_TEXT),//0xffffffff806cc830
+    // .FUN_HV_IOMMU_SET_BUFFERS not needed
+    // .FUN_HV_IOMM_WAIT_COMPLETION not needed
+    .FUN_SMP_RENDEZVOUS = (0xffffffff80cb6100  - KERNEL_TEXT),
+    .FUN_SMP_NO_RENDEVOUS_BARRIER = (0xffffffff804badf0 - KERNEL_TEXT),
+    .HV_CODE_CAVE_PA = 0x62806F00,
+    .HV_HANDLE_VMEXIT_PA = 0x6283D800,
+    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF822C33F8 - KERNEL_TEXT),
+    .KERNEL_CFI_CHECK = (0xffffffff806857a0 - KERNEL_TEXT),
+    .G_VBIOS = (0xFFFFFFFF83EF7A40 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xffffffff80dafcc0 - KERNEL_TEXT),
+    .FUN_MP3_INITIALIZE = (0xffffffff80bcba10 - KERNEL_TEXT),
+    .FUN_MP3_INVOKE = (0xffffffff80bca7d0 - KERNEL_TEXT),
+    .PS5_WIFI_FW_OFFSET = (0xffffffff81655700 - KERNEL_TEXT),
+    .PS5_WIFI_FW_SIZE = 497636,
+};
+ 
+offset_list off_0761 = {
+    // .IOMMU_SOFTC not needed
+    // .VMSPACE_VM_VMID not needed
+    .VMSPACE_VM_PMAP = 0x1D8,
+    // .DATA_BASE_GVMSPACE not needed
+    .ACPIGBL_FACS = (0xFFFFFFFF83AC9C50 - KERNEL_TEXT),
+    .IDT = (0xFFFFFFFF83CDFDF0 - KERNEL_TEXT),
+    .COMMON_TSS = (0xFFFFFFFF83CE2AD0 - KERNEL_TEXT),
+    // .STOPPED_CPUS not needed
+    // .FUN_STOP_CPUS not needed
+    // .FUN_AS_LAPIC_EOI not needed
+    // .FUN_HV_UNMAP_PT_TMR not needed
+    .FUN_MEMCPY = (0xFFFFFFFF80493600 - KERNEL_TEXT),
+    .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80b9da44 - KERNEL_TEXT),
+    .GAD_IRETQ = (0xFFFFFFFF8045480D - KERNEL_TEXT),
+    .GAD_POP_RAX_RET = (0xffffffff8040e9d0 - KERNEL_TEXT),
+    .GAD_POP_RDI_RET = (0xffffffff803f1d78 - KERNEL_TEXT),
+    .GAD_POP_RSI_RET = (0xffffffff803b28b0 - KERNEL_TEXT),
+    .GAD_POP_RDX_RET = (0xffffffff805cd6b4 - KERNEL_TEXT),
+    .GAD_POP_RCX_RET = (0xffffffff804e2231 - KERNEL_TEXT),
+    .GAD_POP_RSP_RET = (0xffffffff8045a850 - KERNEL_TEXT),
+    .GAD_WRMSR_RET = (0xffffffff80451d04 - KERNEL_TEXT),
+    // .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET not needed
+    // .HOOK_ACPI_WAKEUP_MACHDEP not needed
+    .KERNEL_CODE_CAVE = 0x500,
+    .FUN_PRINTF = (0xFFFFFFFF804B05F8 - KERNEL_TEXT),
+    // .FUN_HV_IOMMU_SET_BUFFERS not needed
+    // .FUN_HV_IOMM_WAIT_COMPLETION not needed
+    .FUN_SMP_RENDEZVOUS = (0xFFFFFFFF80CB6710 - KERNEL_TEXT),
+    .FUN_SMP_NO_RENDEVOUS_BARRIER = (0xFFFFFFFF804BABC0 - KERNEL_TEXT),
+    .HV_CODE_CAVE_PA = 0x62806F00,
+    .HV_HANDLE_VMEXIT_PA = 0x6283D800,
+    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF822C33F8 - KERNEL_TEXT),
+    .KERNEL_CFI_CHECK = (0xFFFFFFFF806857B0 - KERNEL_TEXT),
+    .G_VBIOS = (0xFFFFFFFF83EF7A40 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DB02D0 - KERNEL_TEXT),
+    .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BCC020 - KERNEL_TEXT),
+    .FUN_MP3_INVOKE = (0xFFFFFFFF80BCADE0 - KERNEL_TEXT),
+    .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF81655800 - KERNEL_TEXT),
+    .PS5_WIFI_FW_SIZE = 497636,
+};

source/utils.c

@@ -76,6 +76,18 @@ int set_offsets(void) {
   case 0x0602:
     env_offset = off_0602;
     break;
+  case 0x0650:
+    env_offset = off_0650;
+    break;
+  case 0x0720:
+    env_offset = off_0720;
+    break;
+  case 0x0740:
+    env_offset = off_0740;
+    break;
+  case 0x0761:
+    env_offset = off_0761;
+    break;
   default:
     return -1;
   }