starred/ps5debug-NG
1
0 Fork 0
mirror of https://github.com/Pharaoh2k/ps5debug-NG.git synced 2026-10-19 02:19:56 -05:00
Code Issues Packages Projects Releases 8 Wiki Activity

Document content-verified writes and capability 1.1

Browse Source 
Update PROTOCOL.md and README for the verified-write semantics, the per-entry write-multi status codes, the 0xFF adjacent-byte behavior, and the v1.3.2 / capability 1.1 / build-fingerprint branding.
This commit is contained in:
Pharaoh2k committed 2026-07-28 12:32:09 +00:00
1 parent 10c42774f1
commit 23f1471e62
2 files changed
+48 -32
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

PROTOCOL.md
+25 -19
View File
@@ -7,7 +7,7 @@ the sources under `debugger/source/`, `common/`, and the client
value and the on-the-wire value differ (see the bit-swap note in 1.6), both are
given.
This document reflects `ps5debug-NG v1.3.1` (`common/include/version.h`,
This document reflects `ps5debug-NG v1.3.2` (`common/include/version.h`,
`PS5DEBUG_NG_VERSION_STR`). The on-wire **protocol** version reported by
`CMD_VERSION` is a separate string, currently `"1.3"`.
@@ -20,7 +20,7 @@ This document reflects `ps5debug-NG v1.3.1` (`common/include/version.h`,
| Symbol | Value | Source |
|--------------------|----------------------------------|----------------------------------------------------------|
| protocol version | `"1.3"` | `meta.c` `handle_version` (local `char ver[]="1.3"`) |
| branding string | `"ps5debug-NG by OSR v1.3.1\01.0"` | `version.h` `PS5DEBUG_NG_BRAND_STR` via `meta.c` `handle_branding` (NUL-separated capability level appended - see 2.1) |
| branding string | `"ps5debug-NG by OSR v1.3.2 [<fingerprint>]<NUL>1.1"` | `version.h` `PS5DEBUG_NG_BRAND_STR` via `meta.c` `handle_branding` (NUL-separated capability level appended - see 2.1) |
| `PACKET_MAGIC` | `0xFFAABBCC` | `main.c:50` (local `#define`) |
| broadcast magic | `0xFFFFAAAA` | `main.c` `broadcast_thread` (raw literal) |
| auth magic | `0xBB40E64D` | `protocol.h:249` (`CMD_PROC_AUTH_MAGIC`) |
@@ -224,16 +224,17 @@ per-namespace `switch` statements. Three opcodes have no symbolic name at all:
#### `CMD_BRANDING = 0xBD000501`
- **Request body:** none.
- **Response:** `uint32_t length`, then `length` bytes: the human branding string
(`"ps5debug-NG by OSR v1.3.1"`), a single `NUL`, then a **capability level**
string (`"1.0"`), with no trailing NUL. No status word precedes it. (The client
(`"ps5debug-NG by OSR v1.3.2 [<16-hex build fingerprint>]"`), a single `NUL`,
then a **capability level**
string (`"1.1"`), with no trailing NUL. No status word precedes it. (The client
calls this `CMD_EXT_VERSION`.)
- **Capability level:** C-string clients read up to the first `NUL` and see only
the unchanged brand; capability-aware clients read the bytes past the `NUL` to
- **Capability level:** C-string clients read up to the first `NUL` and see the
human brand plus fingerprint; capability-aware clients read the bytes past it to
get the level. The level is bumped as the server gains negotiable features (so a
client can gate a feature on the server advertising at least a given level).
Built from `PS5DEBUG_NG_BRAND_STR "\0" "1.0"` in `meta.c` `handle_branding` -
the literals are split (`"\0" "1.0"`) so `\0` is a NUL byte, not the octal
escape `\01`.
Capability `1.0` introduced write-multi and Turbo Scan; `1.1` adds
content-verified process writes. Built from
`PS5DEBUG_NG_BRAND_STR "\0" "1.1"` in `meta.c` `handle_branding`.
#### `CMD_PLATFORM_ID = 0xBD000502`
- **Request body:** none.
@@ -265,8 +266,13 @@ data" is read from the socket by the handler after a leading `CMD_SUCCESS`.
#### `CMD_PROC_WRITE = 0xBDAA0003` (`proc.c:563`)
- **Request body:** `struct cmd_proc_write_packet` (16 bytes).
- **Response:** `CMD_SUCCESS` (before the data phase), then the server reads
`length` bytes in 64 KiB chunks, then `CMD_SUCCESS` again. **Two** status
words (see 8).
`length` bytes in 64 KiB chunks, then `CMD_SUCCESS` only if every chunk was
written successfully; otherwise the second status is `CMD_ERROR`. **Two**
status words (see 8). DMAP and mdbg writes are read back before acceptance;
a proven DMAP mismatch never falls through to mdbg. A transfer starting at
an address whose low byte is `0xFF` preserves the preceding byte and starts
at `...FE`. This is an adjacent-byte read-modify-write: callers need a stable
or suspended target when that preceding byte can mutate concurrently.
#### `0xBDAACC04` (`proc_write_multi_handle`)
Bulk write - the write counterpart to `0xBDAACC03` (bulk read). Collapses a
@@ -281,14 +287,14 @@ by `proc_handle`; **not** auth-gated (mirrors single write).
- **Response:** `CMD_SUCCESS` (ack), then the server reads and applies each entry
(writing via the same DMAP / mdbg path as `CMD_PROC_WRITE`, in 64 KiB chunks).
If `flags` bit 0 was set, it then sends a `count`-byte status array (one byte per
entry, `0` = ok, `1` = write failed). Finally a trailing `CMD_SUCCESS`. **Two**
entry: `0` = ok; `1` = invalid; `2` = DMAP failure; `3` = content verification
failure; `4` = mdbg failure). It then sends a trailing `CMD_SUCCESS`. **Two**
status words, plus the optional status array between them.
- **Semantics:** best-effort and non-atomic - entries are applied in order and a
failed entry does not stop the rest. Without the status flag, individual write
failures are not reported (same as single `CMD_PROC_WRITE`, whose underlying
`proc_write_mem` is `void`). A `count`/`length` cap violation makes the server
reply `CMD_ERROR` and abort the command (the connection's stream is then
untrustworthy; well-behaved clients stay within the caps).
failed entry does not stop the rest. Without the status flag, any failed entry
makes the trailing status `CMD_ERROR`. A `count`/`length` cap violation makes
the server reply `CMD_ERROR` and abort the command (the connection's stream is
then untrustworthy; well-behaved clients stay within the caps).
#### `CMD_PROC_MAPS = 0xBDAA0004` (`proc.c:597`)
- **Request body:** `struct cmd_proc_maps_packet` (4 bytes, `pid`).
@@ -1062,7 +1068,7 @@ patches applied at install time:
|--------------------------------------|----------------------------------------------------------------------------|
| Process enumeration (`CMD_PROC_LIST`)| Walk the kernel `allproc` linked list with `kernel_copyout_fast` (`proc.c` `proc_list_handle`). |
| Target memory read | `sys_proc_rw_w0` (mdbg), with a DMAP page-table-walk read for Sony-aux regions (`proc.c` `proc_read_mem`). |
| Target memory write | DMAP page-table-walk write on FW >= 8.40 (mdbg write is `EPERM`-gated there), mdbg `sys_proc_rw_w1` otherwise (`proc.c` `proc_write_mem`). |
| Target memory write | Content-verified DMAP page-table-walk write on FW >= 8.40, with an independently read-back mdbg fallback; low-byte-`0xFF` starts are preserve-and-shift normalized (`proc.c`, `kern_rw_fast.c`, `sys_proc_rw.c`). |
| `mprotect` / alloc / free / call / ELF | `sys_proc_cmd` syscall variants (`kdbg.h` `SYS_PROC_*`). |
| Kernel base / kernel R/W | `KERNEL_ADDRESS_DATA_BASE`, `kernel_copyout_fast` / `kernel_copyin_fast` (`kern.c`). |
| VM map (`CMD_PROC_MAPS`) | Read `vmspace` + map entries via `kernel_copyout_fast`, augmented by a page-table walk (`scan.c` `sys_proc_vm_map`, `proc_ptwalk_augment`). |
@@ -1349,7 +1355,7 @@ Documented so a developer does not mistake them for bugs:
---
*This document reflects the `ps5debug-NG v1.3.1` payload
*This document reflects the `ps5debug-NG v1.3.2` payload
(`common/include/version.h`; v1.3.1 added the Turbo Scan cancel command `0xBDAACC17`).
Line numbers cite the sources as of this writing
and may drift; the source under `common/include/protocol.h`,
README.md
+23 -13
View File
@@ -46,6 +46,10 @@ the firmware as a decimal `uint16_t` (e.g. `900` for 9.00, `1240` for 12.40).
### Process inspection and manipulation
- **Enumerate processes** (process name + pid list).
- **Read and write target memory** in streamed chunks.
- **Truthful writes** - pipe setup and transfer results are checked, every
accepted DMAP or mdbg write is read back, and single/multi-write replies
expose failure. Low-byte-`0xFF` transfers use a preserve-and-shift workaround
for FW 10.01; its adjacent byte must remain stable during the operation.
- **List virtual memory maps** - ranges, protections, backing names.
- **Query process metadata** - name, path, titleId, contentId.
- **Identify the foreground app** (`0xBDDD0006`) - returns pid + titleid +
@@ -330,7 +334,8 @@ citations.
## Building
Prerequisites (Ubuntu / Debian):
Release builds require Ubuntu 22.04 and Clang/LLD 18.1.8. The build script
checks both before publishing an ELF.
```sh
sudo apt install bash clang-18 lld-18
@@ -342,16 +347,22 @@ Build:
./build.sh
```
This builds the SDK first (one-time, cached), then the debugger, then the
installer (which embeds the debugger), then publishes `ps5debug-NG.elf` at
the top level. Subsequent runs only rebuild what changed.
This builds the SDK first (one-time, cached), then force-rebuilds the debugger
and installer, and publishes `ps5debug-NG.elf` at the top level. The branding
contains a 16-hex source/configuration fingerprint.
Clean (including the SDK install):
Forced-path diagnostic builds isolate either write engine:
```sh
./build.sh clean
WRITE_DIAG=1 WRITE_PATH=1 ./build.sh # DMAP only
WRITE_DIAG=1 WRITE_PATH=2 ./build.sh # mdbg only
```
Set `WRITE_DIAG=1` only when a full debugger write trace is required. The
bootstrap installer always stays quiet, and stock builds log failures only.
`WRITE_PATH=0` is the normal automatic policy. `./build.sh clean` is disabled;
clean `debugger/` or `installer/` with `make clean` when required.
---
## Deploying
@@ -362,7 +373,7 @@ elfldr from etaHEN-class loaders).
You should see a system notification confirming the payload is alive:
```
ps5debug-NG by OSR v1.3.1 loaded!
ps5debug-NG by OSR v1.3.2 [<build fingerprint>] loaded!
Firmware: 9.00
Coded by OpenSourcereR
Special thanks to
@@ -439,14 +450,13 @@ The vendored SDK is **ps5-payload-sdk v0.38** (commit
`6ae1470fd50c5791e8a8bb728627e657e36eb55a`, dated 2026-04-02). Upstream:
https://github.com/ps5-payload-dev/sdk
To upgrade the SDK:
To upgrade the SDK, replace the vendored source while preserving its symlinks,
then remove only generated build products:
```sh
./build.sh clean
rm -rf ps5-payload-sdk
curl -fsSL https://github.com/ps5-payload-dev/sdk/archive/refs/tags/<TAG>.tar.gz \
| tar xz -C /tmp
mv /tmp/sdk-<TAG_WITHOUT_v> ps5-payload-sdk
make -C debugger clean
make -C installer clean
rm -rf ps5-payload-sdk/install
./build.sh
```