Additive, capability-gated turbo memory-scan path (CC10-CC16); the legacy and
async scan paths stay byte-for-byte unchanged.
- SIMD typed comparator (scan_compare_simd.c) + CC10 caps + CC11 first scan.
- CC12 local-cluster rescan; server-resident survivor sets (CC13 GET / CC14
END); unknown-value bitmap + NVMe snapshot with since-last narrowing and a
materialize-when-sparse handoff to a compact record list.
- Aliasing read engine (scan_alias.c): maps target physical pages into our pmap
via guarded not-present leaf-PTE writes, scanning in place at DRAM bandwidth.
Unified per-2MB-span derivation (proc_ptwalk_span_resolve) makes it page-size
agnostic; verify-before-trust + restore + verify-before-munmap reclaim keep it
safe-to-fail. Opt-in (TSE_ALIASING + TS_USE_ALIASING, default off); mdbg is the
floor. Verifies 1-in-16 maps (derivation is byte-proven, guards prevent faults
regardless) - ~30% faster than verify-every-map.
- Opt-in server-side parallel compare for the aliased exact-match streaming scan
(TSE_PARALLEL_COMPARE + TS_PARALLEL_COMPARE, default off) - for single-
connection clients; multi-connection clients fan out across connections instead.
- Region-parallel multi-pattern AOB scan (CMD_PROC_SCAN_AOB_MULTI, aob_scan.h):
splits the range into per-worker sub-ranges, each scanned once for all patterns
via a shared first-byte dispatch table. Wire and results unchanged.
- Region-classify query (0xBDAACC16): per-region cache attribute (uncached PCD
bit) + measured read throughput, so a client can opt out of slow/uncached
regions. Read-only; the server drops nothing.
HW-validated on FW 9.00.
Rescanning with a "between (A to B)" comparison crashed the console
(SceShellCore SIGSEGV -> kernel panic): proc_scan_count_handle passed
prevValue = NULL, but the async "between" comparator reads its upper bound
from prevValue. Long-standing since v1.2.2; only the async rescan + between
combo triggers it.
- scan.c: for "between", point prev at the upper bound in the scan-value
buffer (pattern + value_length), as proc_scan_start_handle already does.
- scan_compare.c: harden both comparators - cmpType 4-10 return false instead
of dereferencing a NULL prev/extra operand.
- Strip stray comments re-introduced this session (proc.c/scan.c/scan_compare.c)
to match the public-release convention.
Bump version 1.2.6 to 1.2.7.
vm_map nentries/name adjustments were gated to explicit 6/7.0x/8.x cases, so
7.5x (7.20-7.61) and 9.x+ got no adjustment. That broke locating the inject
target on install and left PROC_INFO/PROC_LIST/PROC_MAPS names empty/truncated.
Switch all three sites (installer proc_elf, debugger proc_elf, scan) to a
>= 6.x threshold.
- find_pid: locate SceShellCore via sysctl KERN_PROC_PID/ki_comm
(firmware-agnostic) instead of a per-FW struct proc name offset.
- install_kernel_patch: skip the write when the jailbreak already set the
bits, preventing a kernel panic on 7.61.
- proc_field_offsets: switch to threshold offsets (corrects 7.5x and adds
10/11/12.x).
Features
- Option E: CMD_PROC_MAPS now augments the vm_map list with Sony-aux regions
(SceGnm/SceAgc/JIT/DMEM) that bypass vm_map, discovered via a kernel-side
x86-64 page-table walk over the DMAP. FW-agnostic (runtime pmap-offset
discovery + ground-truth validation); falls back to the plain vm_map result
on any failure.
- Hybrid memory-read path: reads route DMAP-direct for vm_map-absent (aux)
regions and mdbg otherwise (and as fallback), making aux scans ~4x faster on
both the CMD_PROC_READ and server-side scan paths. No protocol change;
byte-identical results.
Fixes
- SW breakpoint wait4-race: eliminate the multi-threaded epilogue-BP SIGSEGV
storm (stale TRAP_TRACE/TRAP_BRKPT absorbers, PT_LWPINFO-gated sibling
rewind, RIP-only fast caches, authid bump around rearm, SIGSEGV-storm guard).
- AOB-multi scan: unique-mode now exits only on invalidated >= pat_count
(matches the original), fixing wrongly-reported-unique / truncated scans.
Performance / robustness
- BP-event latency: select timeout 1000->100 us, poll 100->50 us.
- Per-command debug-state locking (0xBDBB) to prevent BP-slot-table corruption
under concurrent clients.
- Installer: double-load guard (loopback 744 probe), relocation pre-apply plus
batched ptrace_io for faster injection, wait4 instead of a fixed sleep.
Refactor
- Firmware detection rewritten to a direct switch(fw & 0xffff0000) with
per-case version annotations; behavior-preserving (verified equivalent).
Version 1.2.3 -> 1.2.4.
PS5 debugger payload, inspired by Ctn's ps5debug 1.0b5 and
wire-compatible with it. Runs the wire-protocol server inside
SceShellCore via an umtx-loaded installer that injects the embedded
debugger ELF.
Features: process scan/RPC/ELF-inject, on-console scan, full
debugger (breakpoints, watchpoints, single-step, regs/FP/DR access),
kernel R/W, server-side Zydis disassembly, on-console Keystone
assembler (0xBDAA0024), foreground-app metadata (0xBDDD0006),
server-side RBP stack walk (CMD_PROC_READ_STACK), klog forwarder
(TCP 3232), rest-mode survival and a lot more.
Supports FW families 3.x / 4.0 / 4.x (incl. 4.51) / 5.x / 6.x /
7.x / 7.5x / 8.x via the kpatch routine in installer/source/main.c.
GPL-3.0-only.
Pharaoh2k