The default-ON alloc arena reserved a full 16 MB RWX segment on the first plain alloc, then handed out the small request. On a game whose executable/JIT memory pool is nearly full (measured ceiling ~2 MB RWX), the 16 MB reservation fails and proc_alloc returns CMD_ERROR, so a client's attach-time AllocateMemory throws (libdbg status F0000001). 1.2.7 was unaffected because it asked the kernel for exactly the requested size.
Make the arena grow on demand: the first segment for a pid is exactly the request size (a single small hijack, same exposure as the pre-arena path), then segments grow geometrically up to the 16 MB cap as a pid keeps allocating, so heavy clients still amortize. A single-shot miss retreats to the request size and freezes growth for that pid - never a speculative failing probe (each such probe is a target hijack that can catch a lock-holding thread and crash the game).
HW-validated FW 9.00: the previously-failing trainer attach now succeeds.
proc_alloc hijacks an arbitrary game thread and single-steps it through mmap;
if that thread holds a non-sleeping kernel lock, the step's copyin trips the
kernel WITNESS ("copyin: eboot.bin has nonsleeping lock") and crashes the game.
Concurrent hammering accumulates and makes it near-certain.
Serve plain allocations from a per-pid 16MB arena: one hijacking mmap per
segment, then zero-hijack sub-allocation with free-list recycling. This cuts
hijacks from thousands to about one. Default on and transparent to clients
(same wire, valid target addresses); a freed sub-block is recycled rather than
munmap'd and reclaimed when the game exits. Hinted allocations (which need a
specific address) pass straight through. Cap the real-alloc retry storm from
100 to 5. Runtime toggle via raw literal 0xBDAACC24.
HW-validated on FW 4.51: procalloc_stress 3 conns x 2000 iters (6000 cycles)
completes with the game alive (previously a reliable crash at 6-120 hijacks);
smoke 18/18 green.
The variadic __crt_syscall reads each argument as a 64-bit long; a bare int
(e.g. the -1 mmap fd) leaves the upper 32 bits undefined and can fail
call-site-dependently. Route the remaining bare sites through the typed
ps5debug_syscall wrapper (behavior-preserving): net.c select(93), debug.c
wait4(7), proc_remote.c ptrace(26) + wait4(7), installer find_pid.c
sysctl(202), installer proc_remote.c ptrace(26).
Pin LF endings for our C/H/S/Makefile/Markdown/shell/Python files so edits no longer produce spurious whole-file CRLF/LF diffs across machines or editors. Converts the 6 previously-CRLF tracked files to LF (PROTOCOL.md, README.md, debugger/Makefile, debugger/source/proc_remote.c, installer/Makefile, installer/source/main.c). Vendored trees (ps5-payload-sdk, third_party, debugger/third_party) are marked -text and left byte-for-byte unchanged. EOL-only change; no code changes.
Makes the "initial" 8-13.x support from v1.2.5 actually functional.
HW-validated on FW 8.xx, 9.xx, 10.xx and 12.xx (all watchpoint types,
breakpoints, title id, content id, version etc.). FW-agnostic by design; 11/13.x
are lower-risk but not tested.
Memory write (poke) on FW >= 8.40:
- mdbg write op (0x13) is kernel-gated with EPERM on FW >= 8.40, so pokes
failed. Route writes through a DMAP page-table walk (kernel_copyin on the
physical alias) on FW >= 8.40; mdbg stays the path on < 8.40 and as a
fallback.
- PROC_ALLOC pre-faults its pages so writes land on freshly-allocated
demand-zero memory.
Breakpoints / watchpoints on FW 9.x-13.x:
- Extend the kernel-dbreg allowlist to 9.00-13.20; HW BP/WP were silently
no-oping on 9.x+.
- SW (INT3) breakpoints write the 0xCC via the DMAP path (mdbg rejected it
on FW >= 8.40).
- Clear DR6 after each debug exception: FW 11/12 stops re-delivering a
HW BP/WP trap after a few hits when the sticky DR6 status is left set;
plus re-arm the debug regs for data watchpoints.
Game ID / Content ID / Version - firmware-agnostic:
- Resolve title id and content id by pattern-scanning the proc struct
instead of per-FW offsets (which shifted at 8.x and 12.x).
- Foreground-app command resolves the title id robustly so the param.sfo
game version reads correctly on 12.x.
Console crash on client disconnect (SIGPIPE):
- Closing the client mid-operation raised SIGPIPE in the server thread and
killed the host SceShellCore. Suppress it: MSG_NOSIGNAL on sends +
SO_NOSIGPIPE on the sockets.
Load notification now shows the running firmware version, and the credits
line was updated.
Documentation:
- Rewrote PROTOCOL.md against the v1.2.6 sources (commands, packet structs,
status/bit-swap semantics, scan/xref wire formats, enums).
- Corrected and expanded README: per-release firmware support table with
verification status, and accuracy fixes throughout.
Bump version 1.2.5 to 1.2.6.
PS5 debugger payload, inspired by Ctn's ps5debug 1.0b5 and
wire-compatible with it. Runs the wire-protocol server inside
SceShellCore via an umtx-loaded installer that injects the embedded
debugger ELF.
Features: process scan/RPC/ELF-inject, on-console scan, full
debugger (breakpoints, watchpoints, single-step, regs/FP/DR access),
kernel R/W, server-side Zydis disassembly, on-console Keystone
assembler (0xBDAA0024), foreground-app metadata (0xBDDD0006),
server-side RBP stack walk (CMD_PROC_READ_STACK), klog forwarder
(TCP 3232), rest-mode survival and a lot more.
Supports FW families 3.x / 4.0 / 4.x (incl. 4.51) / 5.x / 6.x /
7.x / 7.5x / 8.x via the kpatch routine in installer/source/main.c.
GPL-3.0-only.
Pharaoh2k