CMD_PROC_WRITE and write-multi now read writes back before reporting success: a proven DMAP mismatch no longer falls through to mdbg, and failures surface as CMD_ERROR (single write) or typed per-entry codes (invalid / DMAP / verify / mdbg) for write-multi. A transfer whose start address ends in 0xFF backs up one byte to keep the write aligned; that adjacent-byte read-modify-write needs a stable or suspended target.
Makes the "initial" 8-13.x support from v1.2.5 actually functional.
HW-validated on FW 8.xx, 9.xx, 10.xx and 12.xx (all watchpoint types,
breakpoints, title id, content id, version etc.). FW-agnostic by design; 11/13.x
are lower-risk but not tested.
Memory write (poke) on FW >= 8.40:
- mdbg write op (0x13) is kernel-gated with EPERM on FW >= 8.40, so pokes
failed. Route writes through a DMAP page-table walk (kernel_copyin on the
physical alias) on FW >= 8.40; mdbg stays the path on < 8.40 and as a
fallback.
- PROC_ALLOC pre-faults its pages so writes land on freshly-allocated
demand-zero memory.
Breakpoints / watchpoints on FW 9.x-13.x:
- Extend the kernel-dbreg allowlist to 9.00-13.20; HW BP/WP were silently
no-oping on 9.x+.
- SW (INT3) breakpoints write the 0xCC via the DMAP path (mdbg rejected it
on FW >= 8.40).
- Clear DR6 after each debug exception: FW 11/12 stops re-delivering a
HW BP/WP trap after a few hits when the sticky DR6 status is left set;
plus re-arm the debug regs for data watchpoints.
Game ID / Content ID / Version - firmware-agnostic:
- Resolve title id and content id by pattern-scanning the proc struct
instead of per-FW offsets (which shifted at 8.x and 12.x).
- Foreground-app command resolves the title id robustly so the param.sfo
game version reads correctly on 12.x.
Console crash on client disconnect (SIGPIPE):
- Closing the client mid-operation raised SIGPIPE in the server thread and
killed the host SceShellCore. Suppress it: MSG_NOSIGNAL on sends +
SO_NOSIGPIPE on the sockets.
Load notification now shows the running firmware version, and the credits
line was updated.
Documentation:
- Rewrote PROTOCOL.md against the v1.2.6 sources (commands, packet structs,
status/bit-swap semantics, scan/xref wire formats, enums).
- Corrected and expanded README: per-release firmware support table with
verification status, and accuracy fixes throughout.
Bump version 1.2.5 to 1.2.6.
9-13.x kernel-patch addresses in install_kernel_patch, plus the 12.x proc path offset (0x604). SDK externalization from the original PR was dropped to keep the repo self-contained.
vm_map nentries/name adjustments were gated to explicit 6/7.0x/8.x cases, so
7.5x (7.20-7.61) and 9.x+ got no adjustment. That broke locating the inject
target on install and left PROC_INFO/PROC_LIST/PROC_MAPS names empty/truncated.
Switch all three sites (installer proc_elf, debugger proc_elf, scan) to a
>= 6.x threshold.
- find_pid: locate SceShellCore via sysctl KERN_PROC_PID/ki_comm
(firmware-agnostic) instead of a per-FW struct proc name offset.
- install_kernel_patch: skip the write when the jailbreak already set the
bits, preventing a kernel panic on 7.61.
- proc_field_offsets: switch to threshold offsets (corrects 7.5x and adds
10/11/12.x).
The struct proc name/path/titleid/contentid offsets were hardcoded to the
4.x layout with no firmware gating, so on 6.x and newer they read empty or
garbage: PROC_INFO/PROC_LIST returned blank names and the installer failed
with "SceShellCore not found" on 6.x.
Restore the original's per-firmware selection (three offset sets across
FW 3.x-8.x) behind a shared proc_get_field_offsets() helper that switches on
kernel_get_fw_version(); unsupported firmwares report unknown rather than
emitting wrong offsets. Wired into find_pid, proc_info_handle/proc_list, and
console_foreground_app_handle.
PS5 debugger payload, inspired by Ctn's ps5debug 1.0b5 and
wire-compatible with it. Runs the wire-protocol server inside
SceShellCore via an umtx-loaded installer that injects the embedded
debugger ELF.
Features: process scan/RPC/ELF-inject, on-console scan, full
debugger (breakpoints, watchpoints, single-step, regs/FP/DR access),
kernel R/W, server-side Zydis disassembly, on-console Keystone
assembler (0xBDAA0024), foreground-app metadata (0xBDDD0006),
server-side RBP stack walk (CMD_PROC_READ_STACK), klog forwarder
(TCP 3232), rest-mode survival and a lot more.
Supports FW families 3.x / 4.0 / 4.x (incl. 4.51) / 5.x / 6.x /
7.x / 7.5x / 8.x via the kpatch routine in installer/source/main.c.
GPL-3.0-only.
Pharaoh2k