mirror of
https://github.com/Pharaoh2k/ps5debug-NG.git
synced 2026-10-22 03:42:51 -05:00
OpenSourcereR-dev
72eb2104c7
Makes the "initial" 8-13.x support from v1.2.5 actually functional. HW-validated on FW 8.xx, 9.xx, 10.xx and 12.xx (all watchpoint types, breakpoints, title id, content id, version etc.). FW-agnostic by design; 11/13.x are lower-risk but not tested. Memory write (poke) on FW >= 8.40: - mdbg write op (0x13) is kernel-gated with EPERM on FW >= 8.40, so pokes failed. Route writes through a DMAP page-table walk (kernel_copyin on the physical alias) on FW >= 8.40; mdbg stays the path on < 8.40 and as a fallback. - PROC_ALLOC pre-faults its pages so writes land on freshly-allocated demand-zero memory. Breakpoints / watchpoints on FW 9.x-13.x: - Extend the kernel-dbreg allowlist to 9.00-13.20; HW BP/WP were silently no-oping on 9.x+. - SW (INT3) breakpoints write the 0xCC via the DMAP path (mdbg rejected it on FW >= 8.40). - Clear DR6 after each debug exception: FW 11/12 stops re-delivering a HW BP/WP trap after a few hits when the sticky DR6 status is left set; plus re-arm the debug regs for data watchpoints. Game ID / Content ID / Version - firmware-agnostic: - Resolve title id and content id by pattern-scanning the proc struct instead of per-FW offsets (which shifted at 8.x and 12.x). - Foreground-app command resolves the title id robustly so the param.sfo game version reads correctly on 12.x. Console crash on client disconnect (SIGPIPE): - Closing the client mid-operation raised SIGPIPE in the server thread and killed the host SceShellCore. Suppress it: MSG_NOSIGNAL on sends + SO_NOSIGPIPE on the sockets. Load notification now shows the running firmware version, and the credits line was updated. Documentation: - Rewrote PROTOCOL.md against the v1.2.6 sources (commands, packet structs, status/bit-swap semantics, scan/xref wire formats, enums). - Corrected and expanded README: per-release firmware support table with verification status, and accuracy fixes throughout. Bump version 1.2.5 to 1.2.6.
321 lines
13 KiB
C
321 lines
13 KiB
C
// SPDX-License-Identifier: GPL-3.0-only
|
|
|
|
#include "protocol.h"
|
|
#include "sdk_shim.h"
|
|
#include "kern_rw_fast.h"
|
|
#include <stdint.h>
|
|
#include <stdbool.h>
|
|
|
|
static uint32_t g_fw_cache = 0;
|
|
|
|
bool fw_uses_kernel_dbreg_path(void) {
|
|
uint32_t fw = g_fw_cache;
|
|
if (fw == 0) {
|
|
fw = kernel_get_fw_version();
|
|
g_fw_cache = fw;
|
|
}
|
|
switch (fw & 0xffff0000u) {
|
|
case 0x3000000u: case 0x3100000u: case 0x3200000u: case 0x3210000u: /* 3.00 3.10 3.20 3.21 */
|
|
case 0x4000000u: case 0x4020000u: case 0x4030000u: case 0x4500000u: case 0x4510000u: /* 4.00 4.02 4.03 4.50 4.51 */
|
|
case 0x5000000u: case 0x5020000u: case 0x5100000u: case 0x5500000u: /* 5.00 5.02 5.10 5.50 */
|
|
case 0x6000000u: case 0x6020000u: case 0x6500000u: /* 6.00 6.02 6.50 */
|
|
case 0x7200000u: case 0x7400000u: case 0x7600000u: case 0x7610000u: /* 7.20 7.40 7.60 7.61 (not 7.00/7.01) */
|
|
case 0x8000000u: case 0x8200000u: case 0x8400000u: case 0x8600000u: /* 8.00 8.20 8.40 8.60 */
|
|
case 0x9000000u: case 0x9050000u: case 0x9200000u: case 0x9400000u: case 0x9600000u: /* 9.00 9.05 9.20 9.40 9.60 */
|
|
case 0x10000000u: case 0x10010000u: case 0x10200000u: case 0x10400000u: case 0x10600000u: /* 10.00 10.01 10.20 10.40 10.60 */
|
|
case 0x11000000u: case 0x11200000u: case 0x11400000u: case 0x11600000u: /* 11.00 11.20 11.40 11.60 */
|
|
case 0x12000000u: case 0x12020000u: case 0x12200000u: case 0x12400000u: case 0x12600000u: case 0x12700000u: /* 12.00 12.02 12.20 12.40 12.60 12.70 */
|
|
case 0x13000000u: case 0x13200000u: /* 13.00 13.20 */
|
|
return true;
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
|
|
bool is_process_stopped(int pid) {
|
|
int status;
|
|
if (wait4(pid, &status, 7, NULL) <= 0) return false;
|
|
return ((unsigned char *)&status)[1] == 0x11;
|
|
}
|
|
|
|
bool kern_thread_step_walker(int pid) {
|
|
intptr_t cur_proc = 0;
|
|
intptr_t next_proc = 0;
|
|
int32_t cur_pid = 0;
|
|
|
|
if (kernel_copyout_fast(KERNEL_ADDRESS_ALLPROC, &cur_proc, 8) != 0) return false;
|
|
if (!cur_proc) return false;
|
|
|
|
for (;;) {
|
|
if (kernel_copyout_fast(cur_proc + KERNEL_OFFSET_PROC_P_PID, &cur_pid, 4) != 0)
|
|
return false;
|
|
if (cur_pid == pid) return true;
|
|
if (kernel_copyout_fast(cur_proc, &next_proc, 8) != 0) return false;
|
|
cur_proc = next_proc;
|
|
if (!cur_proc) return false;
|
|
}
|
|
}
|
|
|
|
#define KR_THR_CACHE_N 8
|
|
static struct { int32_t pid; int32_t lwpid; uint64_t kthread; } kr_thr_cache[KR_THR_CACHE_N];
|
|
static int kr_thr_cache_next = 0;
|
|
|
|
void kern_thread_cache_flush(void) {
|
|
for (int i = 0; i < KR_THR_CACHE_N; i++) {
|
|
kr_thr_cache[i].pid = 0; kr_thr_cache[i].lwpid = 0; kr_thr_cache[i].kthread = 0;
|
|
}
|
|
}
|
|
|
|
intptr_t kern_thread_addr(int pid, int lwpid) {
|
|
for (int i = 0; i < KR_THR_CACHE_N; i++) {
|
|
if (kr_thr_cache[i].pid == (int32_t)pid && kr_thr_cache[i].lwpid == (int32_t)lwpid
|
|
&& kr_thr_cache[i].kthread != 0) {
|
|
uint32_t v = 0;
|
|
if (kernel_copyout_fast((intptr_t)(kr_thr_cache[i].kthread + 0x9c), &v, 4) == 0
|
|
&& (int32_t)v == (int32_t)lwpid)
|
|
return (intptr_t)kr_thr_cache[i].kthread;
|
|
kr_thr_cache[i].pid = 0; kr_thr_cache[i].lwpid = 0; kr_thr_cache[i].kthread = 0;
|
|
break;
|
|
}
|
|
}
|
|
|
|
intptr_t kproc = kernel_get_proc_fast((pid_t)pid);
|
|
if (!kproc) return 0;
|
|
|
|
uint8_t chain_hdr[0x30];
|
|
if (kernel_copyout_fast(kproc + 0x10, chain_hdr, 0x30) < 0) return 0;
|
|
intptr_t kthread = *(intptr_t *)chain_hdr;
|
|
|
|
uint8_t tbuf[0x680];
|
|
while (kthread) {
|
|
if (kernel_copyout_fast(kthread, tbuf, 0x680) < 0) return 0;
|
|
if (*(uint32_t *)(tbuf + 0x9c) == (uint32_t)lwpid) {
|
|
kr_thr_cache[kr_thr_cache_next].pid = (int32_t)pid;
|
|
kr_thr_cache[kr_thr_cache_next].lwpid = (int32_t)lwpid;
|
|
kr_thr_cache[kr_thr_cache_next].kthread = (uint64_t)kthread;
|
|
kr_thr_cache_next = (kr_thr_cache_next + 1) % KR_THR_CACHE_N;
|
|
return kthread;
|
|
}
|
|
kthread = *(intptr_t *)(tbuf + 0x10);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
int kern_get_dbregs(int pid, int lwpid, void *dbreg_buf) {
|
|
if (pid == 0) return 1;
|
|
if (!dbreg_buf) return 1;
|
|
|
|
intptr_t kthread = kern_thread_addr(pid, lwpid);
|
|
if (!kthread) return 6;
|
|
|
|
intptr_t pcb_addr;
|
|
if (kernel_copyout_fast(kthread + 0x3f8, &pcb_addr, 8) < 0) return 1;
|
|
|
|
uint8_t pcb_buf[0x178];
|
|
if (kernel_copyout_fast(pcb_addr, pcb_buf, 0x178) < 0) return 1;
|
|
|
|
uint8_t *dst = (uint8_t *)dbreg_buf;
|
|
*(uint64_t *)(dst + 0x00) = *(uint64_t *)(pcb_buf + 0x78);
|
|
*(uint64_t *)(dst + 0x08) = *(uint64_t *)(pcb_buf + 0x80);
|
|
*(uint64_t *)(dst + 0x10) = *(uint64_t *)(pcb_buf + 0x88);
|
|
*(uint64_t *)(dst + 0x18) = *(uint64_t *)(pcb_buf + 0x90);
|
|
*(uint64_t *)(dst + 0x30) = *(uint64_t *)(pcb_buf + 0x98);
|
|
*(uint64_t *)(dst + 0x38) = *(uint64_t *)(pcb_buf + 0xa0);
|
|
return 0;
|
|
}
|
|
|
|
int kern_set_dbregs(int pid, int lwpid, void *dbreg_buf) {
|
|
if (pid == 0) return 1;
|
|
if (!dbreg_buf) return 1;
|
|
|
|
intptr_t kthread = kern_thread_addr(pid, lwpid);
|
|
if (!kthread) return 6;
|
|
|
|
intptr_t pcb_addr;
|
|
if (kernel_copyout_fast(kthread + 0x3f8, &pcb_addr, 8) < 0) return 1;
|
|
|
|
uint8_t pcb_buf[0x178];
|
|
if (kernel_copyout_fast(pcb_addr, pcb_buf, 0x178) < 0) return 1;
|
|
|
|
const uint8_t *src = (const uint8_t *)dbreg_buf;
|
|
*(uint64_t *)(pcb_buf + 0x78) = *(uint64_t *)(src + 0x00);
|
|
*(uint64_t *)(pcb_buf + 0x80) = *(uint64_t *)(src + 0x08);
|
|
*(uint64_t *)(pcb_buf + 0x88) = *(uint64_t *)(src + 0x10);
|
|
*(uint64_t *)(pcb_buf + 0x90) = *(uint64_t *)(src + 0x18);
|
|
*(uint64_t *)(pcb_buf + 0x98) = *(uint64_t *)(src + 0x30);
|
|
*(uint64_t *)(pcb_buf + 0xa0) = *(uint64_t *)(src + 0x38);
|
|
|
|
int rc = kernel_copyin_fast(pcb_buf, pcb_addr, 0x178);
|
|
return (rc < 0) ? 1 : 0;
|
|
}
|
|
|
|
int kern_proc_install_dbregs(int pid, int lwpid, void *fpu_buf) {
|
|
if (pid == 0) return 1;
|
|
if (!fpu_buf) return 1;
|
|
|
|
intptr_t kthread = kern_thread_addr(pid, lwpid);
|
|
if (!kthread) return 6;
|
|
|
|
intptr_t pcb_addr;
|
|
if (kernel_copyout_fast(kthread + 0x3f8, &pcb_addr, 8) < 0) return 1;
|
|
|
|
uint8_t pcb_buf[0x178];
|
|
if (kernel_copyout_fast(pcb_addr, pcb_buf, 0x178) < 0) return 1;
|
|
|
|
intptr_t kfpu_addr = *(intptr_t *)(pcb_buf + 0x148);
|
|
int rc = kernel_copyout_fast(kfpu_addr, fpu_buf, 0x340);
|
|
return (rc < 0) ? 1 : 0;
|
|
}
|
|
|
|
int kern_get_proc_info_by_pid(int pid, int lwpid, void *regs_buf) {
|
|
if (pid == 0) return 1;
|
|
if (!regs_buf) return 1;
|
|
|
|
intptr_t kthread = kern_thread_addr(pid, lwpid);
|
|
if (!kthread) return 1;
|
|
|
|
intptr_t frame_addr;
|
|
if (kernel_copyout_fast(kthread + 0x460, &frame_addr, 8) < 0) return 1;
|
|
|
|
uint8_t fbuf[0x110];
|
|
memset(fbuf, 0, 0x110);
|
|
if (kernel_copyout_fast(frame_addr, fbuf, 0x110) < 0) return 1;
|
|
|
|
uint8_t *dst = (uint8_t *)regs_buf;
|
|
*(uint64_t *)(dst + 0x00) = *(uint64_t *)(fbuf + 0x70);
|
|
*(uint64_t *)(dst + 0x08) = *(uint64_t *)(fbuf + 0x68);
|
|
*(uint64_t *)(dst + 0x10) = *(uint64_t *)(fbuf + 0x60);
|
|
*(uint64_t *)(dst + 0x18) = *(uint64_t *)(fbuf + 0x58);
|
|
*(uint64_t *)(dst + 0x20) = *(uint64_t *)(fbuf + 0x50);
|
|
*(uint64_t *)(dst + 0x28) = *(uint64_t *)(fbuf + 0x48);
|
|
*(uint64_t *)(dst + 0x30) = *(uint64_t *)(fbuf + 0x28);
|
|
*(uint64_t *)(dst + 0x38) = *(uint64_t *)(fbuf + 0x20);
|
|
*(uint64_t *)(dst + 0x40) = *(uint64_t *)(fbuf + 0x00);
|
|
*(uint64_t *)(dst + 0x48) = *(uint64_t *)(fbuf + 0x08);
|
|
*(uint64_t *)(dst + 0x50) = *(uint64_t *)(fbuf + 0x40);
|
|
*(uint64_t *)(dst + 0x58) = *(uint64_t *)(fbuf + 0x38);
|
|
*(uint64_t *)(dst + 0x60) = *(uint64_t *)(fbuf + 0x10);
|
|
*(uint64_t *)(dst + 0x68) = *(uint64_t *)(fbuf + 0x18);
|
|
*(uint64_t *)(dst + 0x70) = *(uint64_t *)(fbuf + 0x30);
|
|
*(uint64_t *)(dst + 0x78) = *(uint64_t *)(fbuf + 0x78);
|
|
*(uint64_t *)(dst + 0x88) = *(uint64_t *)(fbuf + 0xe8);
|
|
*(uint64_t *)(dst + 0x90) = *(uint64_t *)(fbuf + 0xf0);
|
|
*(uint64_t *)(dst + 0x98) = *(uint64_t *)(fbuf + 0xf8);
|
|
*(uint64_t *)(dst + 0xa0) = *(uint64_t *)(fbuf + 0x100);
|
|
*(uint64_t *)(dst + 0xa8) = *(uint64_t *)(fbuf + 0x108);
|
|
*(uint32_t *)(dst + 0x84) = *(uint32_t *)(fbuf + 0x8c);
|
|
*(uint32_t *)(dst + 0x80) = (uint32_t)(*(uint64_t *)(fbuf + 0xe0));
|
|
return 0;
|
|
}
|
|
|
|
int kern_apply_thread_dbgctx(int pid, int lwpid, void *regs_buf) {
|
|
if (pid == 0) return 1;
|
|
if (!regs_buf) return 1;
|
|
|
|
intptr_t kthread = kern_thread_addr(pid, lwpid);
|
|
if (!kthread) return 1;
|
|
|
|
intptr_t frame_addr;
|
|
if (kernel_copyout_fast(kthread + 0x460, &frame_addr, 8) < 0) return 1;
|
|
|
|
uint8_t fbuf[0x110];
|
|
memset(fbuf, 0, 0x110);
|
|
if (kernel_copyout_fast(frame_addr, fbuf, 0x110) < 0) return 1;
|
|
|
|
const uint8_t *src = (const uint8_t *)regs_buf;
|
|
*(uint64_t *)(fbuf + 0x70) = *(uint64_t *)(src + 0x00);
|
|
*(uint64_t *)(fbuf + 0x68) = *(uint64_t *)(src + 0x08);
|
|
*(uint64_t *)(fbuf + 0x60) = *(uint64_t *)(src + 0x10);
|
|
*(uint64_t *)(fbuf + 0x58) = *(uint64_t *)(src + 0x18);
|
|
*(uint64_t *)(fbuf + 0x50) = *(uint64_t *)(src + 0x20);
|
|
*(uint64_t *)(fbuf + 0x48) = *(uint64_t *)(src + 0x28);
|
|
*(uint64_t *)(fbuf + 0x28) = *(uint64_t *)(src + 0x30);
|
|
*(uint64_t *)(fbuf + 0x20) = *(uint64_t *)(src + 0x38);
|
|
*(uint64_t *)(fbuf + 0x00) = *(uint64_t *)(src + 0x40);
|
|
*(uint64_t *)(fbuf + 0x08) = *(uint64_t *)(src + 0x48);
|
|
*(uint64_t *)(fbuf + 0x40) = *(uint64_t *)(src + 0x50);
|
|
*(uint64_t *)(fbuf + 0x38) = *(uint64_t *)(src + 0x58);
|
|
*(uint64_t *)(fbuf + 0x10) = *(uint64_t *)(src + 0x60);
|
|
*(uint64_t *)(fbuf + 0x18) = *(uint64_t *)(src + 0x68);
|
|
*(uint64_t *)(fbuf + 0x30) = *(uint64_t *)(src + 0x70);
|
|
*(uint64_t *)(fbuf + 0x78) = *(uint64_t *)(src + 0x78);
|
|
*(uint64_t *)(fbuf + 0xe8) = *(uint64_t *)(src + 0x88);
|
|
*(uint64_t *)(fbuf + 0xf0) = *(uint64_t *)(src + 0x90);
|
|
*(uint64_t *)(fbuf + 0xf8) = *(uint64_t *)(src + 0x98);
|
|
*(uint64_t *)(fbuf + 0x100) = *(uint64_t *)(src + 0xa0);
|
|
*(uint64_t *)(fbuf + 0x108) = *(uint64_t *)(src + 0xa8);
|
|
*(uint32_t *)(fbuf + 0x8c) = *(uint32_t *)(src + 0x84);
|
|
*(uint64_t *)(fbuf + 0xe0) = (uint64_t)(*(uint32_t *)(src + 0x80));
|
|
|
|
int rc = kernel_copyin_fast(fbuf, frame_addr, 0x110);
|
|
return (rc < 0) ? 1 : 0;
|
|
}
|
|
|
|
int kern_get_lwp_full_state(int pid, int lwpid, void *regs_buf,
|
|
void *dbreg_buf, void *fpu_buf) {
|
|
if (pid == 0) return 1;
|
|
if (!regs_buf) return 1;
|
|
|
|
intptr_t kthread = kern_thread_addr(pid, lwpid);
|
|
if (!kthread) return 1;
|
|
|
|
intptr_t frame_addr;
|
|
if (kernel_copyout_fast(kthread + 0x460, &frame_addr, 8) < 0) return 1;
|
|
|
|
uint8_t fbuf[0x110];
|
|
memset(fbuf, 0, 0x110);
|
|
if (kernel_copyout_fast(frame_addr, fbuf, 0x110) < 0) return 1;
|
|
|
|
uint8_t *dst = (uint8_t *)regs_buf;
|
|
*(uint64_t *)(dst + 0x00) = *(uint64_t *)(fbuf + 0x70);
|
|
*(uint64_t *)(dst + 0x08) = *(uint64_t *)(fbuf + 0x68);
|
|
*(uint64_t *)(dst + 0x10) = *(uint64_t *)(fbuf + 0x60);
|
|
*(uint64_t *)(dst + 0x18) = *(uint64_t *)(fbuf + 0x58);
|
|
*(uint64_t *)(dst + 0x20) = *(uint64_t *)(fbuf + 0x50);
|
|
*(uint64_t *)(dst + 0x28) = *(uint64_t *)(fbuf + 0x48);
|
|
*(uint64_t *)(dst + 0x30) = *(uint64_t *)(fbuf + 0x28);
|
|
*(uint64_t *)(dst + 0x38) = *(uint64_t *)(fbuf + 0x20);
|
|
*(uint64_t *)(dst + 0x40) = *(uint64_t *)(fbuf + 0x00);
|
|
*(uint64_t *)(dst + 0x48) = *(uint64_t *)(fbuf + 0x08);
|
|
*(uint64_t *)(dst + 0x50) = *(uint64_t *)(fbuf + 0x40);
|
|
*(uint64_t *)(dst + 0x58) = *(uint64_t *)(fbuf + 0x38);
|
|
*(uint64_t *)(dst + 0x60) = *(uint64_t *)(fbuf + 0x10);
|
|
*(uint64_t *)(dst + 0x68) = *(uint64_t *)(fbuf + 0x18);
|
|
*(uint64_t *)(dst + 0x70) = *(uint64_t *)(fbuf + 0x30);
|
|
*(uint64_t *)(dst + 0x78) = *(uint64_t *)(fbuf + 0x78);
|
|
*(uint64_t *)(dst + 0x88) = *(uint64_t *)(fbuf + 0xe8);
|
|
*(uint64_t *)(dst + 0x90) = *(uint64_t *)(fbuf + 0xf0);
|
|
*(uint64_t *)(dst + 0x98) = *(uint64_t *)(fbuf + 0xf8);
|
|
*(uint64_t *)(dst + 0xa0) = *(uint64_t *)(fbuf + 0x100);
|
|
*(uint64_t *)(dst + 0xa8) = *(uint64_t *)(fbuf + 0x108);
|
|
*(uint32_t *)(dst + 0x84) = *(uint32_t *)(fbuf + 0x8c);
|
|
*(uint32_t *)(dst + 0x80) = (uint32_t)(*(uint64_t *)(fbuf + 0xe0));
|
|
|
|
if (dbreg_buf || fpu_buf) {
|
|
intptr_t pcb_addr;
|
|
if (kernel_copyout_fast(kthread + 0x3f8, &pcb_addr, 8) < 0) return 1;
|
|
|
|
uint8_t pcb_buf[0x178];
|
|
if (kernel_copyout_fast(pcb_addr, pcb_buf, 0x178) < 0) return 1;
|
|
|
|
if (dbreg_buf) {
|
|
uint8_t *db = (uint8_t *)dbreg_buf;
|
|
*(uint64_t *)(db + 0x00) = *(uint64_t *)(pcb_buf + 0x78);
|
|
*(uint64_t *)(db + 0x08) = *(uint64_t *)(pcb_buf + 0x80);
|
|
*(uint64_t *)(db + 0x10) = *(uint64_t *)(pcb_buf + 0x88);
|
|
*(uint64_t *)(db + 0x18) = *(uint64_t *)(pcb_buf + 0x90);
|
|
*(uint64_t *)(db + 0x30) = *(uint64_t *)(pcb_buf + 0x98);
|
|
*(uint64_t *)(db + 0x38) = *(uint64_t *)(pcb_buf + 0xa0);
|
|
}
|
|
|
|
if (fpu_buf) {
|
|
intptr_t kfpu_addr = *(intptr_t *)(pcb_buf + 0x148);
|
|
if (kfpu_addr) {
|
|
if (kernel_copyout_fast(kfpu_addr, fpu_buf, 0x340) < 0) return 1;
|
|
}
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|