starred/ps5debug-NG
1
0 Fork 0
mirror of https://github.com/Pharaoh2k/ps5debug-NG.git synced 2026-10-21 11:23:27 -05:00
Code Issues Packages Projects Releases 8 Wiki Activity

8 Releases 9 Tags

RSS Feed
  • 1.3.2 fc9aef98f3
    Compare

    ps5debug-NG v1.3.2 Stable

    dean released this 2026-09-22 22:03:38 -05:00 | 2 commits to master since this release

    📅 Originally published on GitHub: Wed, 23 Sep 2026 03:21:00 GMT
    🏷️ Git tag created: Wed, 23 Sep 2026 03:03:38 GMT

    ps5debug-NG v1.3.2

    v1.3.0 was the big feature release. v1.3.2 is the correctness and reliability release that follows it: writes now prove they landed, three separate session-killing bugs are fixed, a scan comparator that silently returned wrong results is repaired, and firmware support extends through FW 13.60.

    There was no separate v1.3.1 download, so this release also contains everything from v1.3.1 (Turbo Scan cancel).

    ⚠️ Read this first: writes are now verified, and that changes what you see

    Process writes used to report success as soon as the write was handed off. They are now read back and compared before success is reported, so a write that silently did nothing now correctly reports a failure.

    If you are a client developer: a write that previously appeared to succeed may now return CMD_ERROR. That is the bug surfacing, not a new bug. Servers advertise capability level 1.1 so clients can detect the behaviour.

    • CMD_PROC_WRITE returns terminal CMD_ERROR on write or verification failure.
    • Write-multi returns typed per-entry status codes (invalid / DMAP / verify / mdbg) so you can tell exactly which entries failed and why, instead of losing the detail in one aggregate result.
    • A proven DMAP mismatch no longer quietly falls through to the mdbg path.
    • Caveat: a transfer whose start address ends in 0xFF backs up one byte to keep the write aligned. That adjacent-byte read-modify-write is not atomic, so it needs a stable or suspended target to be safe.

    🛠️ Session-killing bugs fixed

    • Fixed a debug session wedge that required a console reboot. Toggling a trainer patch while the target was stopped at a breakpoint could deadlock the sole debug worker: an RPC stop was issued against a process the debugger already held ptrace-stopped, so the wait never returned, the worker died, and every reattach afterwards failed (clients reported "Process not connected" / already-debugging) until the console was restarted.
    • Fixed a crash when allocating memory on games with tight executable memory. The allocation arena reserved a full 16 MB RWX segment up front; on a game whose executable pool ceiling is only ~2 MB that reservation fails and attach-time allocation threw. The arena now grows on demand - the first segment is exactly the size requested, then segments grow geometrically up to the cap, so heavy clients still amortise while tight games work. Hardware-validated on FW 9.00.
    • Hardened software breakpoints against 0xCC corruption. Re-arming the same slot at the same address is now idempotent, so the already-patched 0xCC can never be saved as the restore byte (which previously could leave a permanent 0xCC in the target). Arming at address 0 is rejected, moving an enabled slot requires an explicit disarm, and only one INT3 owner per address is allowed across slots.
    • Watchpoints no longer lose which one fired. The event dispatcher's own debug-register accesses were clearing the live DR6 before the client saw it. The event DR6 is now snapshotted and re-applied to the outgoing packet.
    • Stale state can no longer leak into a reattach. Every breakpoint slot and the watchpoint/debug-register shadow are cleared on all teardown paths, including the dead-target exit, so a reconnecting client cannot inherit the previous session's slots.
    • ELF injection scratch mappings now use RWX protection.

    🔎 Scanning

    • Fixed "increased by" / "decreased by" silently behaving like "unchanged". Both comparators read the 8-byte double delta as a 4-byte float, so round values such as 1.0 - whose low 32 bits are all zero - collapsed to 0.0. This affected Turbo Scan and the legacy, regular and async scan/rescan paths. The wire format was always correct, so no client change is needed.
    • Turbo Scan cancel - abort an in-flight scan for a pid instead of waiting it out. Sent from a second connection, since the scanning connection is busy streaming; all parallel workers observe the flag and stop early. A cancelled snapshot frees the half-built snapshot and reports failure; cancelled known-value scans return partial results and the session should be ended or restarted before being trusted.
    • Compact Simple float snapshots - a float/double snapshot using the Simple policy now filters values before storage and keeps only address-sorted survivor records, instead of allocating dense per-slot stores for the entire scanned range first. Large unknown-initial float scans no longer spill or fail at raw-slot scale when only a small survivor set will remain. Negotiated separately from the float policy itself, and clients that do not understand it transparently fall back to streaming.

    🎮 Firmware support: now through FW 13.60

    • Added FW 13.40, 13.42 and 13.60. The full recognised list is now 3.xx through 13.60.
    • 13.60 needed its own handling: its kernel data layout shifted relative to 13.0x-13.4x, so a shared code path would have written the kernel patch to the wrong address.
    • Offsets were derived from decrypted kernel dumps by static analysis, cross-checked against a known-good firmware as a control, and then confirmed on real hardware.
    • Purely additive and firmware-gated - every previously supported firmware is untouched.

    🧰 Build and provenance

    • Branding now carries a 16-hex build fingerprint, so a staged or shared payload can be identified from CMD_BRANDING instead of guessing which build someone is running.
    • build.sh now guards the release build environment, so an official build cannot silently be produced on the wrong toolchain.
    • Added a header that was left untracked when the write path was committed - a fresh clone previously did not build.

    📖 Documentation

    • PROTOCOL.md and README updated for the verified-write semantics, the per-entry write-multi status codes, the 0xFF adjacent-byte behaviour, the Turbo Scan cancel opcode, compact Simple snapshots, and the v1.3.2 / capability 1.1 / build-fingerprint branding.
    • README firmware table extended through 13.60.

    ⚠️ Known caveats

    • The 0xFF-address adjacent-byte read-modify-write described above is not atomic - use it against a stable or suspended target.
    • A cancelled Turbo Scan leaves a known-value session indeterminate; end or restart it before trusting results.
    • AVX-512 (ZMM / opmask) is still unsupported - the PS5 CPU (Zen 2) has no AVX-512, so YMM0-15 remains the complete vector set.
    • Client UI for the per-entry write status codes and for cancel depends on each client; this release provides the server-side support they build on.

    💜 Credits

    • @Pharaoh2k - content-verified writes and capability 1.1, the RPC-deadlock and arena crash fixes, breakpoint/watchpoint hardening, the double-delta comparator fix, Turbo Scan cancel, compact Simple float snapshots, FW 13.40/13.42/13.60 support, build provenance and the documentation pass.
    Downloads
  • 1.3.0 d32d2d001d
    Compare

    ps5debug-NG v1.3.0 Stable

    dean released this 2026-06-21 02:24:06 -05:00 | 17 commits to master since this release

    📅 Originally published on GitHub: Sun, 21 Jun 2026 07:37:35 GMT
    🏷️ Git tag created: Sun, 21 Jun 2026 07:24:06 GMT

    v1.2.x was about getting FW 8.x-13.x working. v1.3.0 is the big feature release: dramatically faster memory scanning (Turbo Scan), new register access (FS/GS base + full AVX/YMM), faster bulk writes, and reliability fixes. Hardware-verified; firmware-agnostic by design.

    🚀 Turbo Scan - much faster memory scanning (~x1.2 - x30 times (!!!) faster than old "Console scan", depends on the scan)

    • A new server-side scan engine with an AVX2 SIMD comparator and a low-overhead aliasing read path that pulls target memory far faster than the classic per-region path.
    • Multi-threaded across memory regions.
    • Big gains where it matters most - value-tracking rescans (find a value, then narrow down) are several times faster, because reading memory was the real bottleneck.
    • Unknown-initial-value snapshot scans - search for a value you can't type yet, then filter by increased / decreased / changed.
    • Region classify query so clients can skip slow / uncached memory regions instead of crawling them.
    • Fully additive and opt-in - every existing scan command is unchanged, so older clients keep working exactly as before.

    🧬 New register access - FS/GS base + AVX/YMM

    • FS/GS segment base read/write - the 64-bit TLS / per-thread base pointers that x86-64 actually uses for thread-local storage. The classic register read only carried the 16-bit segment selectors; the bases (where TLS actually points) are now readable and writable.
    • Full AVX/YMM floating-point registers - reading/writing FP registers now covers the complete 832-byte FPU/AVX state, so the upper halves of YMM0-15 are finally populated and writable. Previously only the 512-byte legacy XMM area came back.
    • These are new server-side capabilities - client UIs can surface them.

    ✍️ Faster bulk memory writes

    • A bulk-write command applies many writes in a single request - far less round-trip overhead when applying large cheat tables or patch sets.

    🛠️ Reliability fixes

    • Fixed a crash when allocating memory under concurrent use. Memory allocation is now served from a server-side per-process arena (one hijacking mmap per segment, then zero-hijack sub-allocation), removing a race that could take down the game / console.
    • Hardened raw syscalls - routed bare syscall sites through a typed wrapper so 32-bit argument values can no longer arrive with garbage upper bits, the cause of rare, hard-to-reproduce failures.

    📖 Documentation

    • PROTOCOL.md brought fully in line with the sources - every command (including the new Turbo Scan family, bulk write, FS/GS base, and the YMM behaviour), every packet struct, status code, and the complete opcode table.
    • README register-capability and command-coverage sections updated.

    ⚠️ Known caveats

    • Client UI for FS/GS base and YMM depends on each client; this release adds the server-side support they build on.

    💜 Credits

    • @Pharaoh2k - Turbo Scan + aliasing read engine, FS/GS base and AVX/YMM register access, bulk write, the proc_alloc arena fix, raw-syscall hardening, and the documentation pass.
    Downloads
  • 1.2.7 14fc8c16b5
    Compare

    ps5debug-NG v1.2.7 Stable

    dean released this 2026-06-03 08:07:18 -05:00 | 24 commits to master since this release

    📅 Originally published on GitHub: Wed, 03 Jun 2026 13:25:04 GMT
    🏷️ Git tag created: Wed, 03 Jun 2026 13:07:18 GMT

    • 🐛 Fixed a critical bug - console crash (KP) when rescanning with "between".

    Notes

    • No other changes from v1.2.6 revision1 (which added the FW 8.40+ poke/breakpoint fix).
    Downloads
  • 1.2.6 54d89306c0
    Compare

    ps5debug-NG v1.2.6 (rev1) Stable

    dean released this 2026-06-02 14:40:48 -05:00 | 26 commits to master since this release

    📅 Originally published on GitHub: Tue, 02 Jun 2026 19:54:13 GMT
    🏷️ Git tag created: Tue, 02 Jun 2026 19:40:48 GMT

    v1.2.5 added initial support for FW 8.x-13.x. v1.2.6 makes it actually functional and adds hardware verification across most firmwares.

    🎮 Firmware support - 8.x through 13.x now working

    • ✅ Hardware-verified: FW 4.x, 6.x, 8.x, 9.x, 10.x and 12.x - poke, software + hardware breakpoints, all watchpoint types, title ID, content ID and version confirmed working.
    • ⚠️ FW 3.x, 5.x, 7.x, 11.x and 13.x: supported but not yet fully tested. The fixes are firmware-agnostic by design. Feedback welcome.

    🔧 Memory write (poke) on FW 8.40+

    • Pokes silently failed on FW ≥ 8.40 (the kernel blocks the old mdbg write path there). Writes now go through a DMAP page-table walk, so poking, cheats and patches work again on 8.40-13.x. (mdbg stays the path on FW ≤ 8.x.)
    • Newly allocated memory is pre-faulted so writes land correctly.

    🔴 Breakpoints & watchpoints on FW 9.x-13.x

    • Hardware breakpoints/watchpoints were silently doing nothing on 9.x+ - now enabled across 9.00-13.20.
    • Software (INT3) breakpoints now write correctly on 9.x+ (same DMAP fix as poke).
    • Fixed breakpoints/watchpoints that fired a few times then stopped on FW 11/12 (the debug-status register wasn't being cleared between hits).

    🏷️ Title ID / Content ID / Version - now firmware-agnostic

    • Game title ID, content ID and version are detected by scanning the process instead of per-firmware offsets (which shifted at 8.x and 12.x). Reaper / Cheater again show the running game correctly on newer firmware.

    💥 Fixed a console crash on client disconnect (SIGPIPE)

    • Closing the client mid-operation (e.g. during a scan) could crash the whole console by killing SceShellCore. Now suppressed - disconnecting is safe. Affects all firmwares.

    🔔 Load notification now shows the firmware version

    • The "loaded" popup now includes a Firmware: x.yy line.

    💜 Credits

    • Added @Pharaoh2k to the special thanks.

    📖 Documentation

    • Rewrote PROTOCOL.md to match the current sources (every command, packet struct, status code and enum), and corrected/expanded the README firmware table with per-release verification status.

    ⚠️ Known caveats

    • FW 3.x, 5.x, 7.x, 11.x and 13.x are supported and quite likely fully working but not yet fully hardware-tested - please report results.
    • FW ≤ 5.x behavior is otherwise unchanged.

    NOTE: The previously attached binary has been replaced by ps5debug-NG_v1.2.6-revision1.elf

    🔁 Revision 1 (ps5debug-NG_v1.2.6-revision1.elf)

    • Fixes memory writes (poke) and software breakpoints on FW 8.40 / 8.60 - the DMAP write path now engages from FW 8.40 instead of 9.00 (a user reported "can't write to memory" on 8.40). 9.x+ already worked and FW < 8.40 is unchanged, so this is the only change from the initial v1.2.6 ps5debug-NG_v1.2.6.elf binary which has been replaced.
    Downloads
  • 1.2.5 be05448527
    Compare

    ps5debug-NG v1.2.5 Stable

    dean released this 2026-05-31 08:17:13 -05:00 | 27 commits to master since this release

    📅 Originally published on GitHub: Sun, 31 May 2026 13:18:50 GMT
    🏷️ Git tag created: Sun, 31 May 2026 13:17:13 GMT

    🎮 Expanded firmware support - now 3.x through 13.x

    • Added initial support for FW 8.x, 9.x, 10.x, 11.x, 12.x and 13.x. ⚠️ These are initial support - testing required (not yet hardware-validated). Feedback from users on these firmwares is welcome.
    • FW 6.x and 7.61 are hardware-validated.

    ✅ Fixed FW 7.5x (7.20 / 7.40 / 7.60 / 7.61)

    Previously these firmwares failed to install (SceShellCore not found) and, even when forced, showed blank process names and truncated memory maps. All fixed:

    • Install now succeeds.
    • PROC_INFO / PROC_LIST show correct process names.
    • PROC_MAPS returns the complete memory map.

    🛠️ Reliability & safety

    • Firmware-agnostic process lookup - the installer now locates the target via a stable system call instead of per-firmware kernel offsets, making install more robust across firmwares.
    • Kernel-patch guard - the installer now detects when the jailbreak has already applied the kernel patch and skips re-writing it, preventing a kernel panic seen on 7.61.
    • Corrected per-firmware process-info offsets - process name / path / title ID / content ID now read correctly on 6.x and newer (were frozen at 4.x values and came back empty on 6.x+).

    💜 Credits

    • Added @EchoStretch and Sonic-Iso to the special thanks.

    ⚠️ Known caveats

    • FW 8.x-13.x: initial support, not yet hardware-tested - use at your own risk and please report results. FW ≤5.x behavior is unchanged.
    Downloads
  • 1.2.4 aef612f6bd
    Compare

    ps5debug-NG v1.2.4 Stable

    dean released this 2026-05-30 07:00:00 -05:00 | 34 commits to master since this release

    📅 Originally published on GitHub: Sat, 30 May 2026 14:23:49 GMT
    🏷️ Git tag created: Sat, 30 May 2026 12:00:00 GMT

    Features

    • CMD_PROC_MAPS now augments the vm_map list with Sony-aux regions
      (SceGnm/SceAgc/JIT/DMEM) that bypass vm_map, discovered via a kernel-side
      x86-64 page-table walk over the DMAP. FW-agnostic (runtime pmap-offset
      discovery + ground-truth validation); falls back to the plain vm_map result
      on any failure.
    • Hybrid memory-read path: reads route DMAP-direct for vm_map-absent (aux)
      regions and mdbg otherwise (and as fallback), improve aux scans performance on
      both the CMD_PROC_READ and server-side scan paths. No protocol change;
      byte-identical results.

    Fixes

    • SW breakpoint wait4-race: eliminate the multi-threaded epilogue-BP SIGSEGV
      storm (stale TRAP_TRACE/TRAP_BRKPT absorbers, PT_LWPINFO-gated sibling
      rewind, RIP-only fast caches, authid bump around rearm, SIGSEGV-storm guard).
    • AOB-multi scan: unique-mode now exits only on invalidated >= pat_count,
      fixing wrongly-reported-unique / truncated scans.

    Performance / robustness

    • BP-event latency: select timeout 1000->100 us, poll 100->50 us.
    • Per-command debug-state locking (0xBDBB) to prevent BP-slot-table corruption
      under concurrent clients.
    • Installer: double-load guard (loopback 744 probe), relocation pre-apply plus
      batched ptrace_io for faster injection, wait4 instead of a fixed sleep.

    Refactor

    • Firmware detection rewritten to a direct switch(fw & 0xffff0000) with
      per-case version annotations; behavior-preserving (verified equivalent).
    Downloads
  • 1.2.3 e299571f94
    Compare

    ps5debug-NG v1.2.3 Stable

    dean released this 2026-05-15 12:40:27 -05:00 | 38 commits to master since this release

    📅 Originally published on GitHub: Fri, 15 May 2026 18:17:14 GMT
    🏷️ Git tag created: Fri, 15 May 2026 17:40:27 GMT

    Hotfix: Fixed a rare save-corruption issue

    Downloads
  • 1.2.2 9c649a44dc
    Compare

    ps5debug-NG v1.2.2 Stable

    dean released this 2026-05-14 01:44:35 -05:00 | 41 commits to master since this release

    📅 Originally published on GitHub: Thu, 14 May 2026 07:11:44 GMT
    🏷️ Git tag created: Thu, 14 May 2026 06:44:35 GMT

    Initial stable public release

    Downloads