proc.c, sys_proc_rw.c, both kern_rw_fast.c and proc_ptwalk.c include write_policy.h, but it was left untracked when that feature was committed, so a fresh checkout did not build. Add it: it defines the auto/DMAP/mdbg write-path selection (PS5DEBUG_FORCE_WRITE_PATH), the 0xFF adjacent-byte prefix helper, and the diagnostics toggle.
Branding advertises capability level 1.1 (content-verified writes) and now carries a 16-hex build fingerprint injected by build.sh and the debugger/installer Makefiles, so a staged ELF is identifiable from CMD_BRANDING.
CMD_PROC_WRITE and write-multi now read writes back before reporting success: a proven DMAP mismatch no longer falls through to mdbg, and failures surface as CMD_ERROR (single write) or typed per-entry codes (invalid / DMAP / verify / mdbg) for write-multi. A transfer whose start address ends in 0xFF backs up one byte to keep the write aligned; that adjacent-byte read-modify-write needs a stable or suspended target.
Abort an in-flight TURBOSCAN START/COUNT for a pid via a pid-scoped flag the scan loops poll (all parallel workers observe it) and stop early, emitting their normal terminator. Sent from a second connection since the scanning connection is busy streaming. A cancelled snapshot create frees the half-built snapshot and reports snapshot_ok=0; known-value START and COUNT rescan return partial results (session left indeterminate - END or restart before trusting). START/COUNT clear a stale same-pid flag on entry so a scan is never pre-cancelled. Auth bit 1 required.
Bumps version 1.3.0 -> 1.3.1 and documents the opcode in PROTOCOL.md/README. Raw-literal opcode (no CMD_* macro), per the enumerated-set rule.
proc_alloc hijacks an arbitrary game thread and single-steps it through mmap;
if that thread holds a non-sleeping kernel lock, the step's copyin trips the
kernel WITNESS ("copyin: eboot.bin has nonsleeping lock") and crashes the game.
Concurrent hammering accumulates and makes it near-certain.
Serve plain allocations from a per-pid 16MB arena: one hijacking mmap per
segment, then zero-hijack sub-allocation with free-list recycling. This cuts
hijacks from thousands to about one. Default on and transparent to clients
(same wire, valid target addresses); a freed sub-block is recycled rather than
munmap'd and reclaimed when the game exits. Hinted allocations (which need a
specific address) pass straight through. Cap the real-alloc retry storm from
100 to 5. Runtime toggle via raw literal 0xBDAACC24.
HW-validated on FW 4.51: procalloc_stress 3 conns x 2000 iters (6000 cycles)
completes with the game alive (previously a reliable crash at 6-120 hijacks);
smoke 18/18 green.
Additive, capability-gated turbo memory-scan path (CC10-CC16); the legacy and
async scan paths stay byte-for-byte unchanged.
- SIMD typed comparator (scan_compare_simd.c) + CC10 caps + CC11 first scan.
- CC12 local-cluster rescan; server-resident survivor sets (CC13 GET / CC14
END); unknown-value bitmap + NVMe snapshot with since-last narrowing and a
materialize-when-sparse handoff to a compact record list.
- Aliasing read engine (scan_alias.c): maps target physical pages into our pmap
via guarded not-present leaf-PTE writes, scanning in place at DRAM bandwidth.
Unified per-2MB-span derivation (proc_ptwalk_span_resolve) makes it page-size
agnostic; verify-before-trust + restore + verify-before-munmap reclaim keep it
safe-to-fail. Opt-in (TSE_ALIASING + TS_USE_ALIASING, default off); mdbg is the
floor. Verifies 1-in-16 maps (derivation is byte-proven, guards prevent faults
regardless) - ~30% faster than verify-every-map.
- Opt-in server-side parallel compare for the aliased exact-match streaming scan
(TSE_PARALLEL_COMPARE + TS_PARALLEL_COMPARE, default off) - for single-
connection clients; multi-connection clients fan out across connections instead.
- Region-parallel multi-pattern AOB scan (CMD_PROC_SCAN_AOB_MULTI, aob_scan.h):
splits the range into per-worker sub-ranges, each scanned once for all patterns
via a shared first-byte dispatch table. Wire and results unchanged.
- Region-classify query (0xBDAACC16): per-region cache attribute (uncached PCD
bit) + measured read throughput, so a client can opt out of slow/uncached
regions. Read-only; the server drops nothing.
HW-validated on FW 9.00.
- New 0xBDAACC04 bulk-write command (proc.c proc_write_multi_handle), dispatched
raw (no name macro). Collapses N CMD_PROC_WRITE round-trips into one: header
{pid,count,flags} then count streamed {u64 addr,u32 len,bytes} entries; two
CMD_SUCCESS words. Interleaved streaming keeps server memory bounded to one
64KiB scratch. Not auth-gated (mirrors single write). Caps: count<=0xFFFF,
entry<=0x100000 -> CMD_ERROR + abort. Opt-in per-entry status byte array via
flags bit 0 (PROC_WRITE_MULTI_F_STATUS), using a returning proc_write_mem
variant (ptwalk ret + mdbg bytes-written); single write + breakpoint callers
untouched.
- CMD_BRANDING (meta.c) now returns brand + NUL + capability level "1.0" so
capability-aware clients gate features without probing. Split literal
"\0" "1.0" (not octal \01).
- version.h 1.2.7 -> 1.2.8. PROTOCOL.md documents both.
HW-validated (wire test). Sources not yet comment-stripped (pre-push step).
Rescanning with a "between (A to B)" comparison crashed the console
(SceShellCore SIGSEGV -> kernel panic): proc_scan_count_handle passed
prevValue = NULL, but the async "between" comparator reads its upper bound
from prevValue. Long-standing since v1.2.2; only the async rescan + between
combo triggers it.
- scan.c: for "between", point prev at the upper bound in the scan-value
buffer (pattern + value_length), as proc_scan_start_handle already does.
- scan_compare.c: harden both comparators - cmpType 4-10 return false instead
of dereferencing a NULL prev/extra operand.
- Strip stray comments re-introduced this session (proc.c/scan.c/scan_compare.c)
to match the public-release convention.
Bump version 1.2.6 to 1.2.7.
Makes the "initial" 8-13.x support from v1.2.5 actually functional.
HW-validated on FW 8.xx, 9.xx, 10.xx and 12.xx (all watchpoint types,
breakpoints, title id, content id, version etc.). FW-agnostic by design; 11/13.x
are lower-risk but not tested.
Memory write (poke) on FW >= 8.40:
- mdbg write op (0x13) is kernel-gated with EPERM on FW >= 8.40, so pokes
failed. Route writes through a DMAP page-table walk (kernel_copyin on the
physical alias) on FW >= 8.40; mdbg stays the path on < 8.40 and as a
fallback.
- PROC_ALLOC pre-faults its pages so writes land on freshly-allocated
demand-zero memory.
Breakpoints / watchpoints on FW 9.x-13.x:
- Extend the kernel-dbreg allowlist to 9.00-13.20; HW BP/WP were silently
no-oping on 9.x+.
- SW (INT3) breakpoints write the 0xCC via the DMAP path (mdbg rejected it
on FW >= 8.40).
- Clear DR6 after each debug exception: FW 11/12 stops re-delivering a
HW BP/WP trap after a few hits when the sticky DR6 status is left set;
plus re-arm the debug regs for data watchpoints.
Game ID / Content ID / Version - firmware-agnostic:
- Resolve title id and content id by pattern-scanning the proc struct
instead of per-FW offsets (which shifted at 8.x and 12.x).
- Foreground-app command resolves the title id robustly so the param.sfo
game version reads correctly on 12.x.
Console crash on client disconnect (SIGPIPE):
- Closing the client mid-operation raised SIGPIPE in the server thread and
killed the host SceShellCore. Suppress it: MSG_NOSIGNAL on sends +
SO_NOSIGPIPE on the sockets.
Load notification now shows the running firmware version, and the credits
line was updated.
Documentation:
- Rewrote PROTOCOL.md against the v1.2.6 sources (commands, packet structs,
status/bit-swap semantics, scan/xref wire formats, enums).
- Corrected and expanded README: per-release firmware support table with
verification status, and accuracy fixes throughout.
Bump version 1.2.5 to 1.2.6.
The struct proc name/path/titleid/contentid offsets were hardcoded to the
4.x layout with no firmware gating, so on 6.x and newer they read empty or
garbage: PROC_INFO/PROC_LIST returned blank names and the installer failed
with "SceShellCore not found" on 6.x.
Restore the original's per-firmware selection (three offset sets across
FW 3.x-8.x) behind a shared proc_get_field_offsets() helper that switches on
kernel_get_fw_version(); unsupported firmwares report unknown rather than
emitting wrong offsets. Wired into find_pid, proc_info_handle/proc_list, and
console_foreground_app_handle.
Features
- Option E: CMD_PROC_MAPS now augments the vm_map list with Sony-aux regions
(SceGnm/SceAgc/JIT/DMEM) that bypass vm_map, discovered via a kernel-side
x86-64 page-table walk over the DMAP. FW-agnostic (runtime pmap-offset
discovery + ground-truth validation); falls back to the plain vm_map result
on any failure.
- Hybrid memory-read path: reads route DMAP-direct for vm_map-absent (aux)
regions and mdbg otherwise (and as fallback), making aux scans ~4x faster on
both the CMD_PROC_READ and server-side scan paths. No protocol change;
byte-identical results.
Fixes
- SW breakpoint wait4-race: eliminate the multi-threaded epilogue-BP SIGSEGV
storm (stale TRAP_TRACE/TRAP_BRKPT absorbers, PT_LWPINFO-gated sibling
rewind, RIP-only fast caches, authid bump around rearm, SIGSEGV-storm guard).
- AOB-multi scan: unique-mode now exits only on invalidated >= pat_count
(matches the original), fixing wrongly-reported-unique / truncated scans.
Performance / robustness
- BP-event latency: select timeout 1000->100 us, poll 100->50 us.
- Per-command debug-state locking (0xBDBB) to prevent BP-slot-table corruption
under concurrent clients.
- Installer: double-load guard (loopback 744 probe), relocation pre-apply plus
batched ptrace_io for faster injection, wait4 instead of a fixed sleep.
Refactor
- Firmware detection rewritten to a direct switch(fw & 0xffff0000) with
per-case version annotations; behavior-preserving (verified equivalent).
Version 1.2.3 -> 1.2.4.
- dispatch_debug_events: drop the function-wide elev_save_and_set
wrapping; macro DDE_RETURN simplified to return (v).
- debug_attach_handle: release elevation before wait4 + resume_app,
re-acquire only for PT_CONTINUE.
- debug_full_teardown / debug_set_watchpoint_handle: use new
resume_app_unelev helper so the libk LNC notification fires
outside the elevated cred window.
- common/include/version.h: single source of truth for the
brand/version strings used in meta.c (handle_branding) and
main.c (loaded_msg).
PS5 debugger payload, inspired by Ctn's ps5debug 1.0b5 and
wire-compatible with it. Runs the wire-protocol server inside
SceShellCore via an umtx-loaded installer that injects the embedded
debugger ELF.
Features: process scan/RPC/ELF-inject, on-console scan, full
debugger (breakpoints, watchpoints, single-step, regs/FP/DR access),
kernel R/W, server-side Zydis disassembly, on-console Keystone
assembler (0xBDAA0024), foreground-app metadata (0xBDDD0006),
server-side RBP stack walk (CMD_PROC_READ_STACK), klog forwarder
(TCP 3232), rest-mode survival and a lot more.
Supports FW families 3.x / 4.0 / 4.x (incl. 4.51) / 5.x / 6.x /
7.x / 7.5x / 8.x via the kpatch routine in installer/source/main.c.
GPL-3.0-only.
Pharaoh2k