add 7.60 support (#34)

* Update README.md

7.40 Support

* Update README.md

add 7.40 support

* Update offsets.h

add 7.40 support

* Update utils.c

add 7.40 support

* Update offsets.c

add 7.40 support

README.md

@@ -7,23 +7,25 @@ Features:
 - HDMI 4K60 video and audio output
 - M.2 SSD as dedicated Linux partition
 - All USB ports usable for peripherals
-- Ethernet port usable via custom Gigabit Ethernet driver
+- BD drive usable via custom ahci driver
+- Internal Bluetooth usable via custom xhci driver
+- Ethernet port usable via custom gbe driver
 
 ![Alt Text](logo.webp)
 
 ## PS5 firmware
 
-*ps5-linux* is currently only supported on PS5 Phat on the following firmwares:
+*ps5-linux* is only supported on PS5 Phat and Slim on the following firmwares:
 
 - **3.00**, **3.10**, **3.20**, **3.21** without M.2 support
 - **4.00**, **4.02**, **4.03**, **4.50**, **4.51** with M.2 support
 - **5.00**, **5.02**, **5.10**, **5.50** with M.2 support
-- **6.00**, **6.02** with M.2 support
+- **6.00**, **6.02**, **6.50** with M.2 support
-- **7.61** with M.2 support
+- **7.20**, **7.40**, **7.60**, **7.61** with M.2 support
 
 Support for 1.xx and 2.xx firmwares may be added in the future, but we will not prioritize this effort.
 
-If you want to update to a specific firmware, [download the correct PUP](https://darthsternie.net/ps5-firmwares/) and follow the [official guide](https://www.playstation.com/en-us/support/hardware/reinstall-playstation-system-software-safe-mode) to upgrade your PS5. **Obviously you cannot downgrade.**
+If you are on firmwares in-between or you want to update to a specific firmware, [download the correct PUP](https://darthsternie.net/ps5-firmwares/) and follow the [official guide](https://www.playstation.com/en-us/support/hardware/reinstall-playstation-system-software-safe-mode) to upgrade your PS5. **Obviously you cannot downgrade.**
 
 ## Hardwares
 
@@ -197,7 +199,7 @@ Then, there are certain settings and commands we recommend doing:
    make
    ```
 
-7. Install the mwifiex driver for the internal Marvell WLAN chip (`40:00.7 Ethernet controller [0200]: Marvell Technology Group Ltd. Device [1b4b:2b56] (rev 02)`):
+7. If you have a Marvell WLAN chip (`lspci -nn` shows `40:00.7 Ethernet controller [0200]: Marvell Technology Group Ltd. Device [1b4b:2b56] (rev 02)`), then you can install the WLAN driver:
 
    ```bash
    git clone https://github.com/ps5-linux/ps5-linux-mwifiex
@@ -258,7 +260,7 @@ For any future ps5-linux updates, you can download the `.deb` or `.pkg.tar.zst`
 
 ## FAQ
 
-- Q: Will higher >=6.50 firmwares be supported?
+- Q: Will higher >=8.00 firmwares be supported?
   - A: No.
 - Q: Why can I not use M.2 on 3.xx?
   - A: Because the PS5 fails to boot with it attached.
@@ -269,9 +271,9 @@ For any future ps5-linux updates, you can download the `.deb` or `.pkg.tar.zst`
 - Q: Can I continue using my PS5 if I install Linux?
   - A: Yes, the internal SSD is not modified
 - Q: Can I use the PS5's NIC/WLAN module in Linux?
-  - A: In theory yes, but someone needs to write or adapt drivers to use them.
+  - A: WLAN is only supported for Marvell chipsets at the moment. Ethernet is supported on all models.
 - Q: Does the DualSense controller work?
-  - A: Via a Bluetooth dongle. Built-in Bluetooth is not yet supported.
+  - A: Yes, via internal Bluetooth as well as Bluetooth dongle.
 - Q: What resolutions and refresh rates are supported?
   - A: 1080p, 1440p and 2160p at 60Hz are broadly supported. 1440p@120Hz has been the only confirmed working on the DELL S3225QC yet. 120Hz or 30Hz may be added in the future.
 - Q: After reboot, I get a "Repairing" screen and "Your PS5 wasn't turned off properly." screen. Is that normal?

include/offsets.h

@@ -67,6 +67,10 @@ extern offset_list off_0510;
 extern offset_list off_0550;
 extern offset_list off_0600;
 extern offset_list off_0602;
+extern offset_list off_0650;
+extern offset_list off_0720;
+extern offset_list off_0740;
+extern offset_list off_0760;
 extern offset_list off_0761;
 
 #endif

shellcode_0607/main.c

@@ -1,12 +1,20 @@
 #include "utils.h"
 
-// 7.61 offsets
+// 7.xx offsets
-#define HV_REENTER_HYPERCORE 0x0000000062806380
+#define HV_REENTER_HYPERCORE_07xx 0x0000000062806380ULL
-#define HV_STACK_TABLE 0x000000006282E120
+#define HV_STACK_TABLE_07xx 0x000000006282E120ULL
-#define HV_PML4 0x000000006282E1A0
+#define HV_PML4_07xx 0x000000006282E1A0ULL
-#define HV_ENTRY 0x000000006282E1B8
+#define HV_ENTRY_07xx 0x000000006282E1B8ULL
-#define HV_MAIN 0x0000000000000E20
+#define HV_MAIN_07xx 0x0000000000000E20
-#define G_VM_TAB 0x0000000000027C80
+#define G_VM_TAB_07xx 0x0000000000027C80
+
+// 6.50 offsets
+#define HV_REENTER_HYPERCORE_0650 0x0000000062806780ULL
+#define HV_STACK_TABLE_0650 0x000000006282D0C0ULL
+#define HV_PML4_0650 0x000000006282D140ULL
+#define HV_ENTRY_0650 0x000000006282D158ULL
+#define HV_MAIN_0650 0x0000000000000F10
+#define G_VM_TAB_0650 0x0000000000023C80
 
 #define MSR_APICBASE 0x01b
 #define MSR_GSBASE 0xc0000101
@@ -19,11 +27,17 @@
 #define NESTED_CTRL_NP_ENABLE 0x1
 
 __attribute__((section(".entry_point"), naked)) uint32_t main(void) {
-  uint64_t hv_pml4 = *(uint64_t *)HV_PML4;
+  volatile int fw_version = 0x11AA11AA; // To be updated by loader
-  uint64_t hv_base = *(uint64_t *)HV_ENTRY - HV_MAIN;
 
-  uintptr_t *g_vm_tab =
+  uint64_t hv_pml4 =
-      (uintptr_t *)vtophys_custom(hv_base + G_VM_TAB, hv_pml4);
+      *(uint64_t *)(fw_version == 0x0650 ? HV_PML4_0650 : HV_PML4_07xx);
+  uint64_t hv_base = fw_version == 0x0650
+                         ? (*(uint64_t *)HV_ENTRY_0650 - HV_MAIN_0650)
+                         : (*(uint64_t *)HV_ENTRY_07xx - HV_MAIN_07xx);
+
+  uintptr_t *g_vm_tab = (uintptr_t *)vtophys_custom(
+      hv_base + (fw_version == 0x0650 ? G_VM_TAB_0650 : G_VM_TAB_07xx),
+      hv_pml4);
   for (int i = 0; i < 16; i++) {
     uintptr_t vc = vtophys_custom(g_vm_tab[i], hv_pml4);
     uintptr_t vmcb = vtophys_custom(*(uintptr_t *)(vc + 0x08), hv_pml4);
@@ -42,10 +56,15 @@ __attribute__((section(".entry_point"), naked)) uint32_t main(void) {
   wrmsr(MSR_APICBASE, DEFAULT_APIC_BASE | APICBASE_ENABLED | APICBASE_BSP);
 
   // Restore gs base.
-  wrmsr(MSR_GSBASE, ((uint64_t *)HV_STACK_TABLE)[0] + 0x1000);
+  wrmsr(MSR_GSBASE,
+        ((uint64_t *)(fw_version == 0x0650 ? HV_STACK_TABLE_0650
+                                           : HV_STACK_TABLE_07xx))[0] +
+            0x1000);
 
   // Reenter hypercore.
-  void (*hv_reenter_hypercore)(void) = (void *)HV_REENTER_HYPERCORE;
+  void (*hv_reenter_hypercore)(void) =
+      (void *)(fw_version == 0x0650 ? HV_REENTER_HYPERCORE_0650
+                                    : HV_REENTER_HYPERCORE_07xx);
   hv_reenter_hypercore();
   while (1)
     ;

shellcode_kernel/boot_linux.c

@@ -79,7 +79,7 @@ static inline uint64_t vmmcall(uint64_t nr, uint64_t a0, uint64_t a1,
 static uint64_t get_hv_shm(void) {
   if (args.fw_version >= 0x0500 && args.fw_version < 0x0600) {
     return 0x62a01000;
-  } else if (args.fw_version >= 0x0600 && args.fw_version < 0x0650) {
+  } else if (args.fw_version >= 0x0600 && args.fw_version < 0x0800) {
     return 0x62a22000;
   }
   return -1;
@@ -188,7 +188,7 @@ void boot_linux(void) {
   memcpy(&info, (void *)args.linux_info_va, sizeof(struct linux_info));
 
   info.n_tmrs = 0;
-  if (args.fw_version >= 0x0500 && args.fw_version < 0x0650) {
+  if (args.fw_version >= 0x0500 && args.fw_version < 0x0800) {
     SceSblHvShm *shm = (SceSblHvShm *)PHYS_TO_DMAP(get_hv_shm());
 
     for (int i = 0; i < 64; i++) {

source/hv_defeat_0607.c

@@ -29,9 +29,12 @@ static void setidt(int idx, uintptr_t func, int typ, int dpl, int ist) {
 }
 
 static uint64_t get_hv_stack(void) {
-  if (fw == 0x0761) {
+  if (fw >= 0x0720 && fw < 0x0800) {
     return 0x628ec000;
   }
+  if (fw == 0x0650) {
+    return 0x628d0000;
+  }
   return -1;
 }
 
@@ -84,12 +87,32 @@ static void build_sx_rop(uintptr_t ist, size_t shellcode_kernel_len) {
   kwrite(ist + 0x1000, rop_buf, (uintptr_t)rop - (uintptr_t)rop_buf);
 }
 
+static int update_sc_fw_version(uint64_t shellcode) {
+  // Find the address 0x11AA11AA used as marker
+  int offset = -1;
+  for (uint64_t i = 0; i < 0x40; i++) {
+    if (*(uint32_t *)(shellcode + i) == 0x11AA11AA) {
+      offset = i;
+      break;
+    }
+  }
+  if (offset == -1) {
+    notify("Could not find offset of shellcode fw version - Aborting\n");
+    return -1;
+  }
+  *(uint32_t *)(shellcode + offset) = fw;
+  return 0;
+}
+
 int hv_defeat_0607(void *shellcode_kernel, size_t shellcode_kernel_len) {
   void *shellcode_0607 =
       mmap(NULL, ALIGN_UP(shellcode_0607_bin_len, PAGE_SIZE),
            PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
   memcpy(shellcode_0607, shellcode_0607_bin, shellcode_0607_bin_len);
 
+  if (update_sc_fw_version((uint64_t)shellcode_0607))
+    return -1;
+
   for (int i = 0; i < shellcode_0607_bin_len; i += PAGE_SIZE) {
     install_page_syscore(kernel_cave_shellcode_0761 + i,
                          vtophys_user((uintptr_t)shellcode_0607 + i), 0);

source/offsets.c

@@ -466,6 +466,176 @@ offset_list off_0602 = {
     .PS5_WIFI_FW_SIZE = 494536,
 };
 
+offset_list off_0650 = {
+    // .IOMMU_SOFTC not needed
+    // .VMSPACE_VM_VMID not needed
+    .VMSPACE_VM_PMAP = 0x1D8,
+    // .DATA_BASE_GVMSPACE not needed
+    .ACPIGBL_FACS = (0xffffffff83c04540 - KERNEL_TEXT),
+    .IDT = (0xffffffff873cdde0 - KERNEL_TEXT),
+    .COMMON_TSS = (0xffffffff873d0a00 - KERNEL_TEXT),
+    // .STOPPED_CPUS not needed
+    // .FUN_STOP_CPUS not needed
+    // .FUN_AS_LAPIC_EOI not needed
+    // .FUN_HV_UNMAP_PT_TMR not needed
+    .FUN_MEMCPY = (0xffffffff804935b0 - KERNEL_TEXT),
+    .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80bb7224 - KERNEL_TEXT),
+    .GAD_IRETQ = (0xffffffff804547ed - KERNEL_TEXT),
+    .GAD_POP_RAX_RET = (0xffffffff8040eb50 - KERNEL_TEXT),
+    .GAD_POP_RDI_RET = (0xffffffff803f1ef8 - KERNEL_TEXT),
+    .GAD_POP_RSI_RET = (0xffffffff803b2a30 - KERNEL_TEXT),
+    .GAD_POP_RDX_RET = (0xffffffff80536a32 - KERNEL_TEXT),
+    //.GAD_POP_RCX_RET = (0xffffffff8033ba53 - KERNEL_TEXT),
+    .GAD_POP_RCX_RET = (0xffffffff804e68b8 - KERNEL_TEXT),
+    .GAD_POP_RSP_RET = (0xffffffff8045a830 - KERNEL_TEXT),
+    .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff8061421a - KERNEL_TEXT),
+    .GAD_WRMSR_RET = (0xffffffff80451e84 - KERNEL_TEXT),
+    // .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET not needed
+    // .HOOK_ACPI_WAKEUP_MACHDEP not needed
+    .KERNEL_CODE_CAVE = 0x500,
+    .FUN_PRINTF = (0xffffffff806d2610 - KERNEL_TEXT),
+    // .FUN_HV_IOMMU_SET_BUFFERS not needed
+    // .FUN_HV_IOMM_WAIT_COMPLETION not needed
+    .FUN_SMP_RENDEZVOUS = (0xffffffff80cd20e0 - KERNEL_TEXT),
+    .FUN_SMP_NO_RENDEVOUS_BARRIER = (0xffffffff804bc370 - KERNEL_TEXT),
+    .HV_CODE_CAVE_PA = 0x62806F00,
+    .HV_HANDLE_VMEXIT_PA = 0x62841D50,
+    .KERNEL_UART_OVERRIDE = (0xffffffff822d25c8 - KERNEL_TEXT),
+    .KERNEL_CFI_CHECK = (0xffffffff80689a20 - KERNEL_TEXT),
+    .G_VBIOS = (0xffffffff875dfa50 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xffffffff80dcb990 - KERNEL_TEXT),
+    .FUN_MP3_INITIALIZE = (0xffffffff80be4190 - KERNEL_TEXT),
+    .FUN_MP3_INVOKE = (0xffffffff80be2f10 - KERNEL_TEXT),
+    .PS5_WIFI_FW_OFFSET = (0xffffffff81665b90 - KERNEL_TEXT),
+    .PS5_WIFI_FW_SIZE = 494536,
+};
+
+offset_list off_0720 = {
+    // .IOMMU_SOFTC not needed
+    // .VMSPACE_VM_VMID not needed
+    .VMSPACE_VM_PMAP = 0x1D8,
+    // .DATA_BASE_GVMSPACE not needed
+    .ACPIGBL_FACS = (0xffffffff83ac9c50 - KERNEL_TEXT),
+    .IDT = (0xffffffff83cdfdf0 - KERNEL_TEXT),
+    .COMMON_TSS = (0xffffffff83ce2ad0 - KERNEL_TEXT),
+    // .STOPPED_CPUS not needed
+    // .FUN_STOP_CPUS not needed
+    // .FUN_AS_LAPIC_EOI not needed
+    // .FUN_HV_UNMAP_PT_TMR not needed
+    .FUN_MEMCPY = (0xffffffff80493600 - KERNEL_TEXT),
+    .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80c435ff - KERNEL_TEXT),
+    .GAD_IRETQ = (0xffffffff809c52e8 - KERNEL_TEXT),
+    .GAD_POP_RAX_RET = (0xffffffff80e4c2d5 - KERNEL_TEXT),
+    .GAD_POP_RDI_RET = (0xffffffff80dfe38b - KERNEL_TEXT),
+    .GAD_POP_RSI_RET = (0xffffffff80dfdd9e - KERNEL_TEXT),
+    .GAD_POP_RDX_RET = (0xffffffff80a4fd38 - KERNEL_TEXT),
+    .GAD_POP_RCX_RET = (0xffffffff80e24def - KERNEL_TEXT),
+    .GAD_POP_RSP_RET = (0xffffffff80e2b4c0 - KERNEL_TEXT),
+    .GAD_WRMSR_RET = (0xffffffff80451d04 - KERNEL_TEXT),
+    // .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET not needed
+    // .HOOK_ACPI_WAKEUP_MACHDEP not needed
+    .KERNEL_CODE_CAVE = 0x500,
+    .FUN_PRINTF = (0xffffffff806cc830 - KERNEL_TEXT),
+    // .FUN_HV_IOMMU_SET_BUFFERS not needed
+    // .FUN_HV_IOMM_WAIT_COMPLETION not needed
+    .FUN_SMP_RENDEZVOUS = (0xffffffff80cb6100 - KERNEL_TEXT),
+    .FUN_SMP_NO_RENDEVOUS_BARRIER = (0xffffffff804c0820 - KERNEL_TEXT),
+    .HV_CODE_CAVE_PA = 0x62806F00,
+    .HV_HANDLE_VMEXIT_PA = 0x6283D800,
+    .KERNEL_UART_OVERRIDE = (0xffffffff822c33f8 - KERNEL_TEXT),
+    .KERNEL_CFI_CHECK = (0xffffffff806857a0 - KERNEL_TEXT),
+    .G_VBIOS = (0xffffffff83ef7a40 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xffffffff80dafcc0 - KERNEL_TEXT),
+    .FUN_MP3_INITIALIZE = (0xffffffff80bcba10 - KERNEL_TEXT),
+    .FUN_MP3_INVOKE = (0xffffffff80bca7d0 - KERNEL_TEXT),
+    .PS5_WIFI_FW_OFFSET = (0xffffffff81655700 - KERNEL_TEXT),
+    .PS5_WIFI_FW_SIZE = 497636,
+};
+
+offset_list off_0740 = {
+    // .IOMMU_SOFTC not needed
+    // .VMSPACE_VM_VMID not needed
+    .VMSPACE_VM_PMAP = 0x1D8,
+    // .DATA_BASE_GVMSPACE not needed
+    .ACPIGBL_FACS = (0xFFFFFFFF83AC9C50 - KERNEL_TEXT),
+    .IDT = (0xFFFFFFFF83CDFDF0 - KERNEL_TEXT),
+    .COMMON_TSS = (0xFFFFFFFF83CE2AD0 - KERNEL_TEXT),
+    // .STOPPED_CPUS not needed
+    // .FUN_STOP_CPUS not needed
+    // .FUN_AS_LAPIC_EOI not needed
+    // .FUN_HV_UNMAP_PT_TMR not needed
+    .FUN_MEMCPY = (0xFFFFFFFF80493600 - KERNEL_TEXT),
+    .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80c435ff - KERNEL_TEXT),
+    .GAD_IRETQ = (0xffffffff8045480d - KERNEL_TEXT),
+    .GAD_POP_RAX_RET = (0xffffffff8040e9d0 - KERNEL_TEXT),
+    .GAD_POP_RDI_RET = (0xffffffff803f1d78 - KERNEL_TEXT),
+    .GAD_POP_RSI_RET = (0xffffffff803b28b0 - KERNEL_TEXT),
+    .GAD_POP_RDX_RET = (0xffffffff805cd53c - KERNEL_TEXT),
+    .GAD_POP_RCX_RET = (0xffffffff80e24def - KERNEL_TEXT),
+    .GAD_POP_RSP_RET = (0xffffffff8045a850 - KERNEL_TEXT),
+    .GAD_WRMSR_RET = (0xffffffff80451d04 - KERNEL_TEXT),
+    // .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET not needed
+    // .HOOK_ACPI_WAKEUP_MACHDEP not needed
+    .KERNEL_CODE_CAVE = 0x500,
+    .FUN_PRINTF = (0xffffffff804b19f0 - KERNEL_TEXT),//0xffffffff806cc830
+    // .FUN_HV_IOMMU_SET_BUFFERS not needed
+    // .FUN_HV_IOMM_WAIT_COMPLETION not needed
+    .FUN_SMP_RENDEZVOUS = (0xffffffff80cb6100  - KERNEL_TEXT),
+    .FUN_SMP_NO_RENDEVOUS_BARRIER = (0xffffffff804badf0 - KERNEL_TEXT),
+    .HV_CODE_CAVE_PA = 0x62806F00,
+    .HV_HANDLE_VMEXIT_PA = 0x6283D800,
+    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF822C33F8 - KERNEL_TEXT),
+    .KERNEL_CFI_CHECK = (0xffffffff806857a0 - KERNEL_TEXT),
+    .G_VBIOS = (0xFFFFFFFF83EF7A40 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xffffffff80dafcc0 - KERNEL_TEXT),
+    .FUN_MP3_INITIALIZE = (0xffffffff80bcba10 - KERNEL_TEXT),
+    .FUN_MP3_INVOKE = (0xffffffff80bca7d0 - KERNEL_TEXT),
+    .PS5_WIFI_FW_OFFSET = (0xffffffff81655700 - KERNEL_TEXT),
+    .PS5_WIFI_FW_SIZE = 497636,
+};
+
+offset_list off_0760 = {
+    // .IOMMU_SOFTC not needed
+    // .VMSPACE_VM_VMID not needed
+    .VMSPACE_VM_PMAP = 0x1D8,
+    // .DATA_BASE_GVMSPACE not needed
+    .ACPIGBL_FACS = (0xFFFFFFFF83AC9C50 - KERNEL_TEXT),
+    .IDT = (0xFFFFFFFF83CDFDF0 - KERNEL_TEXT),
+    .COMMON_TSS = (0xFFFFFFFF83CE2AD0 - KERNEL_TEXT),
+    // .STOPPED_CPUS not needed
+    // .FUN_STOP_CPUS not needed
+    // .FUN_AS_LAPIC_EOI not needed
+    // .FUN_HV_UNMAP_PT_TMR not needed
+    .FUN_MEMCPY = (0xFFFFFFFF80493600 - KERNEL_TEXT),
+    .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80b9da44 - KERNEL_TEXT),
+    .GAD_IRETQ = (0xFFFFFFFF8045480D - KERNEL_TEXT),
+    .GAD_POP_RAX_RET = (0xffffffff8040e9d0 - KERNEL_TEXT), 
+    .GAD_POP_RDI_RET = (0xffffffff803f1d78 - KERNEL_TEXT),
+    .GAD_POP_RSI_RET = (0xffffffff803b28b0 - KERNEL_TEXT),
+    .GAD_POP_RDX_RET = (0xffffffff8078d502 - KERNEL_TEXT),
+    .GAD_POP_RCX_RET = (0xffffffff804e2231 - KERNEL_TEXT),
+    .GAD_POP_RSP_RET = (0xffffffff8045a850 - KERNEL_TEXT),
+    .GAD_WRMSR_RET = (0xffffffff80451d04 - KERNEL_TEXT),
+    // .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET not needed
+    // .HOOK_ACPI_WAKEUP_MACHDEP not needed
+    .KERNEL_CODE_CAVE = 0x500,
+    .FUN_PRINTF = (0xFFFFFFFF804B1DB8 - KERNEL_TEXT), 
+    // .FUN_HV_IOMMU_SET_BUFFERS not needed
+    // .FUN_HV_IOMM_WAIT_COMPLETION not needed
+    .FUN_SMP_RENDEZVOUS = (0xFFFFFFFF80CB6710  - KERNEL_TEXT),
+    .FUN_SMP_NO_RENDEVOUS_BARRIER = (0xFFFFFFFF804BD280 - KERNEL_TEXT),
+    .HV_CODE_CAVE_PA = 0x62806F00, 
+    .HV_HANDLE_VMEXIT_PA = 0x6283D800,
+    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF822C33F8 - KERNEL_TEXT),
+    .KERNEL_CFI_CHECK = (0xFFFFFFFF806857B0 - KERNEL_TEXT),
+    .G_VBIOS = (0xFFFFFFFF83EF7A40 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DB02D0 - KERNEL_TEXT),
+    .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BCC020 - KERNEL_TEXT),
+    .FUN_MP3_INVOKE = (0xFFFFFFFF80BCADE0 - KERNEL_TEXT),
+    .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF81655800 - KERNEL_TEXT),
+    .PS5_WIFI_FW_SIZE = 497636,
+};
+
 offset_list off_0761 = {
     // .IOMMU_SOFTC not needed
     // .VMSPACE_VM_VMID not needed

source/utils.c

@@ -76,6 +76,18 @@ int set_offsets(void) {
   case 0x0602:
     env_offset = off_0602;
     break;
+  case 0x0650:
+    env_offset = off_0650;
+    break;
+  case 0x0720:
+    env_offset = off_0720;
+    break;
+  case 0x0740:
+    env_offset = off_0740;
+    break;
+  case 0x0760:
+    env_offset = off_0760;
+    break;
   case 0x0761:
     env_offset = off_0761;
     break;