The installer kpatch address is security_flags+0x24, so 13.40 and 13.42 join
the existing 13.0x case while 13.60 gets its own at 0xD9C088. Folding 13.60
into the shared case would have OR-ed the patch bits into the wrong kernel
address, the same failure mode as the ps4 10.50/10.70 dispatch mis-route.
Also add the three firmwares to fw_uses_kernel_dbreg_path(), otherwise
hardware breakpoints and watchpoints silently do nothing on them, and list
them in the README firmware table.
The remaining firmware-dependent code is threshold-based and already selects
the right values for 13.4x/13.6x, and the page-table walker discovers pm_pml4
at runtime, so nothing else needed changing.
CMD_PROC_WRITE and write-multi now read writes back before reporting success: a proven DMAP mismatch no longer falls through to mdbg, and failures surface as CMD_ERROR (single write) or typed per-entry codes (invalid / DMAP / verify / mdbg) for write-multi. A transfer whose start address ends in 0xFF backs up one byte to keep the write aligned; that adjacent-byte read-modify-write needs a stable or suspended target.
The variadic __crt_syscall reads each argument as a 64-bit long; a bare int
(e.g. the -1 mmap fd) leaves the upper 32 bits undefined and can fail
call-site-dependently. Route the remaining bare sites through the typed
ps5debug_syscall wrapper (behavior-preserving): net.c select(93), debug.c
wait4(7), proc_remote.c ptrace(26) + wait4(7), installer find_pid.c
sysctl(202), installer proc_remote.c ptrace(26).
Pin LF endings for our C/H/S/Makefile/Markdown/shell/Python files so edits no longer produce spurious whole-file CRLF/LF diffs across machines or editors. Converts the 6 previously-CRLF tracked files to LF (PROTOCOL.md, README.md, debugger/Makefile, debugger/source/proc_remote.c, installer/Makefile, installer/source/main.c). Vendored trees (ps5-payload-sdk, third_party, debugger/third_party) are marked -text and left byte-for-byte unchanged. EOL-only change; no code changes.
9-13.x kernel-patch addresses in install_kernel_patch, plus the 12.x proc path offset (0x604). SDK externalization from the original PR was dropped to keep the repo self-contained.
vm_map nentries/name adjustments were gated to explicit 6/7.0x/8.x cases, so
7.5x (7.20-7.61) and 9.x+ got no adjustment. That broke locating the inject
target on install and left PROC_INFO/PROC_LIST/PROC_MAPS names empty/truncated.
Switch all three sites (installer proc_elf, debugger proc_elf, scan) to a
>= 6.x threshold.
- find_pid: locate SceShellCore via sysctl KERN_PROC_PID/ki_comm
(firmware-agnostic) instead of a per-FW struct proc name offset.
- install_kernel_patch: skip the write when the jailbreak already set the
bits, preventing a kernel panic on 7.61.
- proc_field_offsets: switch to threshold offsets (corrects 7.5x and adds
10/11/12.x).
The struct proc name/path/titleid/contentid offsets were hardcoded to the
4.x layout with no firmware gating, so on 6.x and newer they read empty or
garbage: PROC_INFO/PROC_LIST returned blank names and the installer failed
with "SceShellCore not found" on 6.x.
Restore the original's per-firmware selection (three offset sets across
FW 3.x-8.x) behind a shared proc_get_field_offsets() helper that switches on
kernel_get_fw_version(); unsupported firmwares report unknown rather than
emitting wrong offsets. Wired into find_pid, proc_info_handle/proc_list, and
console_foreground_app_handle.
Features
- Option E: CMD_PROC_MAPS now augments the vm_map list with Sony-aux regions
(SceGnm/SceAgc/JIT/DMEM) that bypass vm_map, discovered via a kernel-side
x86-64 page-table walk over the DMAP. FW-agnostic (runtime pmap-offset
discovery + ground-truth validation); falls back to the plain vm_map result
on any failure.
- Hybrid memory-read path: reads route DMAP-direct for vm_map-absent (aux)
regions and mdbg otherwise (and as fallback), making aux scans ~4x faster on
both the CMD_PROC_READ and server-side scan paths. No protocol change;
byte-identical results.
Fixes
- SW breakpoint wait4-race: eliminate the multi-threaded epilogue-BP SIGSEGV
storm (stale TRAP_TRACE/TRAP_BRKPT absorbers, PT_LWPINFO-gated sibling
rewind, RIP-only fast caches, authid bump around rearm, SIGSEGV-storm guard).
- AOB-multi scan: unique-mode now exits only on invalidated >= pat_count
(matches the original), fixing wrongly-reported-unique / truncated scans.
Performance / robustness
- BP-event latency: select timeout 1000->100 us, poll 100->50 us.
- Per-command debug-state locking (0xBDBB) to prevent BP-slot-table corruption
under concurrent clients.
- Installer: double-load guard (loopback 744 probe), relocation pre-apply plus
batched ptrace_io for faster injection, wait4 instead of a fixed sleep.
Refactor
- Firmware detection rewritten to a direct switch(fw & 0xffff0000) with
per-case version annotations; behavior-preserving (verified equivalent).
Version 1.2.3 -> 1.2.4.
PS5 debugger payload, inspired by Ctn's ps5debug 1.0b5 and
wire-compatible with it. Runs the wire-protocol server inside
SceShellCore via an umtx-loaded installer that injects the embedded
debugger ELF.
Features: process scan/RPC/ELF-inject, on-console scan, full
debugger (breakpoints, watchpoints, single-step, regs/FP/DR access),
kernel R/W, server-side Zydis disassembly, on-console Keystone
assembler (0xBDAA0024), foreground-app metadata (0xBDDD0006),
server-side RBP stack walk (CMD_PROC_READ_STACK), klog forwarder
(TCP 3232), rest-mode survival and a lot more.
Supports FW families 3.x / 4.0 / 4.x (incl. 4.51) / 5.x / 6.x /
7.x / 7.5x / 8.x via the kpatch routine in installer/source/main.c.
GPL-3.0-only.
Pharaoh2k