ps5-kstuff: build payloads as frankenELF

gdb_stub/dbg.c

@@ -245,7 +245,8 @@ extern char _start[];
 #ifndef OBJECT_FILE
 static void reloc_commands()
 {
-    unsigned long long diff = ((unsigned long long)_start) - 0x401000;
+    static unsigned long long start_nonreloc = (unsigned long long)_start;
+    unsigned long long diff = ((unsigned long long)_start) - start_nonreloc;
     for(int i = 0; i < sizeof(commands) / sizeof(commands[0]); i++)
         commands[i] += diff;
 }
@@ -751,6 +752,7 @@ int gdbstub_main_loop(struct trap_state* ts, ssize_t* result, int* ern)
             skip_to_end(o);
             start_packet(o);
             unsigned long long base_addr = ((unsigned long long)_start);
+            static unsigned long long start_nonreloc = (unsigned long long)_start;
 #if defined(BLOB) || defined(OBJECT_FILE)
             base_addr &= ~(PAGE_SIZE-1);
             char probe;
@@ -758,7 +760,7 @@ int gdbstub_main_loop(struct trap_state* ts, ssize_t* result, int* ern)
                 base_addr -= PAGE_SIZE;
             base_addr += PAGE_SIZE;
 #else
-            base_addr -= 4096;
+            base_addr -= (start_nonreloc - 0x400000);
 #endif
             char buf[24] = "TextSeg=";
             for(int i = 15; i >= 0; i--)

lib/Makefile

@@ -1,14 +1,20 @@
-all: lib.a lib-ps5.a
+all: lib.a lib-ps5.a lib-elf.a
 
 clean:
-	rm -f lib.a lib-ps5.a *.o syscalls.asm syscalls-ps5.asm
+	rm -f lib.a lib-*.a *.o syscalls.asm syscalls-ps5.asm
 
 dl.o: dl.c
 	gcc -c -isystem ../freebsd-headers -nostdinc -fno-stack-protector dl.c -o dl.o -fPIE -ffreestanding
 
+crt-elf-c.o: crt-elf-c.c
+	gcc -c -isystem ../freebsd-headers -nostdinc -fno-stack-protector -O3 crt-elf-c.c -o crt-elf-c.o -fPIE -ffreestanding
+
 crt.o: crt.asm
 	yasm -f elf64 crt.asm
 
+crt-elf.o: crt-elf.asm
+	yasm -f elf64 crt-elf.asm
+
 rfork.o: rfork.asm
 	yasm -f elf64 rfork.asm
 
@@ -29,3 +35,6 @@ lib.a: crt.o rfork.o dl.o syscalls.o
 
 lib-ps5.a: crt.o dl.o syscalls-ps5.o
 	ld -r crt.o dl.o syscalls-ps5.o -o lib-ps5.a
+
+lib-elf.a: crt-elf.o crt-elf-c.o dl.o syscalls.o
+	ld -r crt-elf.o crt-elf-c.o dl.o syscalls.o -o lib-elf.a

lib/crt-elf-c.c

@@ -0,0 +1,18 @@
+#include <sys/types.h>
+
+struct specter_args
+{
+    void* dlsym;
+    int* pipe;
+    int* rwpair;
+    uint64_t kpipe_addr;
+    uint64_t kdata_base;
+    int* retval;
+};
+
+uint64_t _start(void* dlsym, int master, int victim, uint64_t pktopts, uint64_t kdata_base);
+
+void elf_main(struct specter_args* args)
+{
+    *args->retval = _start(args->dlsym, args->rwpair[0], args->rwpair[1], 0, args->kdata_base);
+}

lib/crt-elf.asm

@@ -0,0 +1,53 @@
+use64
+
+global _start
+extern main
+extern addr__dynlib_dlsym
+extern elf_main
+extern _end
+
+section .text.startup ; needed for correct linkage with -O2
+
+_start:
+jmp start2
+db 'E', 'L', 'F' ; internal magic for the patcher script
+dq _sdata-_start
+start2:
+jmp start3
+
+times 24-($-_start) db 0
+dq elf_main-_start
+dq 64
+
+times 56-($-_start) db 0
+dw 2
+
+times 64-($-_start) db 0
+
+; segment 1 -- rx
+dd 1
+dd 5
+dq 0
+dq 0
+dq 0
+dq _sdata-_start
+dq _sdata-_start
+dq 0
+
+; segment 2 -- rw
+dd 1
+dd 6
+dq _sdata-_start
+dq _sdata-_start
+dq _sdata-_start
+dq _end-_start
+dq _end-_start
+dq 0
+
+start3:
+mov [rel addr__dynlib_dlsym], rdi
+jmp main
+
+section .data
+_sdata:
+db 1

prosper0gdb/r0gdb.c

@@ -1408,4 +1408,18 @@ void r0gdb_init(void* ds, int a, int b, uintptr_t c, uintptr_t d)
     victim_pktopts = c;
     kdata_base = d;
     init_pipe();
+    if(!victim_pktopts)
+    {
+        uint64_t fd;
+        copyout(&fd, proc+0x48, 8);
+        uint64_t ofiles;
+        copyout(&ofiles, fd, 8);
+        uint64_t victim_file;
+        copyout(&victim_file, ofiles+8+victim_fd*48, 8);
+        uint64_t victim_sock;
+        copyout(&victim_sock, victim_file, 8);
+        uint64_t so_pcb;
+        copyout(&so_pcb, victim_sock+24, 8);
+        copyout(&victim_pktopts, so_pcb+288, 8);
+    }
 }

ps5-kstuff/Makefile

@@ -3,7 +3,7 @@ all: payload.bin payload-gdb.bin
 clean:
 	rm -f payload.elf payload.bin payload-gdb.elf payload-gdb.bin freebsd-loader kelf kelf.o structs.h structs.inc uelf/uelf uelf/uelf.bin uelf/crt.o
 
-../lib/lib.a:
+../lib/lib-elf.a:
 	cd ../lib; make
 
 ../prosper0gdb/prosper0gdb.o:
@@ -12,15 +12,15 @@ clean:
 structs.inc: structs-ps5.inc
 	cp structs-ps5.inc structs.inc
 
-payload.elf: ../lib/lib.a ../prosper0gdb/prosper0gdb.o main.c sqlite_triggers.c kelf uelf/uelf.bin
-	gcc -O0 -isystem ../freebsd-headers -nostdinc -nostdlib -fno-stack-protector -static ../lib/lib.a ../prosper0gdb/prosper0gdb.o main.c ../prosper0gdb/dbg.c sqlite_triggers.c -Wl,-gc-sections -o payload.elf -fPIE -ffreestanding -no-pie -Wl,-z,max-page-size=16384
+payload.elf: ../lib/lib-elf.a ../prosper0gdb/prosper0gdb.o main.c sqlite_triggers.c kelf uelf/uelf.bin
+	gcc -O0 -isystem ../freebsd-headers -nostdinc -nostdlib -fno-stack-protector -static ../lib/lib-elf.a ../prosper0gdb/prosper0gdb.o main.c ../prosper0gdb/dbg.c sqlite_triggers.c -Wl,-gc-sections -o payload.elf -fPIE -ffreestanding -no-pie -Wl,-z,max-page-size=16384
 
-payload-gdb.elf: ../lib/lib.a ../prosper0gdb/prosper0gdb.o main.c sqlite_triggers.c utils.c kelf uelf/uelf
-	gcc -O0 -g -isystem ../freebsd-headers -nostdinc -nostdlib -fno-stack-protector -static ../lib/lib.a ../prosper0gdb/prosper0gdb.o -DDEBUG main.c ../prosper0gdb/dbg.c sqlite_triggers.c utils.c -o payload-gdb.elf -fPIE -ffreestanding -no-pie -Wl,-z,max-page-size=16384
+payload-gdb.elf: ../lib/lib-elf.a ../prosper0gdb/prosper0gdb.o main.c sqlite_triggers.c utils.c kelf uelf/uelf
+	gcc -O0 -g -isystem ../freebsd-headers -nostdinc -nostdlib -fno-stack-protector -static ../lib/lib-elf.a ../prosper0gdb/prosper0gdb.o -DDEBUG main.c ../prosper0gdb/dbg.c sqlite_triggers.c utils.c -o payload-gdb.elf -fPIE -ffreestanding -no-pie -Wl,-z,max-page-size=16384
 
 payloa%.bin: payloa%.elf
 	objcopy $< --only-section .text --only-section .data --only-section .bss --only-section .rodata -O binary $@
-	file $@ | fgrep -q '$@: DOS executable (COM)'
+	python3 ../lib/frankenelf.py $@
 
 kelf.o: kelf.asm structs.inc
 	yasm -f elf64 -g dwarf2 kelf.asm -o kelf.o
@@ -35,7 +35,7 @@ uelf/crt.o: uelf/crt.asm
 	yasm uelf/crt.asm -f elf64 -o uelf/crt.o
 
 uelf/uelf: uelf/*.c uelf/*.h structs.h uelf/crt.o BearSSL/build/libbearssl.a libtomcrypt/libtomcrypt.a
-	gcc -Wl,-Bsymbolic -Wl,-gc-sections -ffunction-sections -fdata-sections -O3 -g -isystem ../freebsd-headers -nostdinc -nostdlib -mgeneral-regs-only -fno-stack-protector -fPIE -fPIC -shared -fvisibility=hidden -ffreestanding uelf/crt.o uelf/*.c -L BearSSL/build -lbearssl -L libtomcrypt -ltomcrypt -o uelf/uelf
+	gcc -Wl,-Bsymbolic -Wl,-gc-sections -ffunction-sections -fdata-sections -O3 -g -isystem ../freebsd-headers -nostdinc -nostdlib -mgeneral-regs-only -fno-stack-protector -fPIE -fPIC -shared -fvisibility=hidden -ffreestanding uelf/crt.o uelf/*.c -L BearSSL/build -lbearssl -L libtomcrypt -ltomcrypt -o uelf/uelf -Wl,-z,max-page-size=4096
 
 uelf/uelf.bin: uelf/uelf
 	objcopy --strip-all $< $@

ps5-kstuff/main.c

@@ -642,6 +642,7 @@ int main(void* ds, int a, int b, uintptr_t c, uintptr_t d)
         } notification = { .f1 = -1, .msg = "ps5-kstuff successfully loaded" };
         ((void(*)())dlsym((void*)0x2001, "sceKernelSendNotificationRequest"))(0, &notification, 0xc30, 0);
     }
+    return 0;
 #endif
     asm volatile("ud2");
     return 0;