Locating Sysconf

[JumpR]

Hey,

I've been trying this for awhile, searched all over the web, and I think the best place to ask it is here.
I'm trying to locate the sysconf_plugin_module, my first attempt was the following (Pseudo-C):

Code: Select all

	sceKernelDelayThread(2000000);
	sceKernelDcacheWritebackAll();
	u32 *start = (u32 *)sceKernelFindModuleByName("sysconf_plugin_module");
	u32 module = *(start+27);

That didn't seem to work, however, turning the delay thread into 15 seconds, booting the PSP, and rushing to a settings menu, allowed me to relocate the module, but that's a bit annoying for the end user.

So, sysconf doesn't seem to load on boot yet, so I need an alternative to find it.

Any help is appreciated,
JumpR

[TyRaNiD]

Few questions...

1) Why?
2) Why?
3) See 1 and 2

[JumpR]

Few questions...

1) Why?
2) Why?
3) See 1 and 2

I want to apply some memory patches in sysconf. Oh, oops, I confused relocate with locate, I modified the post, my apologies.

[jimparis]

I think you mean "locate" not "relocate".

[JumpR]

I think you mean "locate" not "relocate".

Indeed. Sorry, didn't think of the difference at first, English is not my first language, locating is a bit more logic to do then relocating, I'll edit first post.
I feel quite emberassed.

[SilverSpring]

It's a vsh plugin so it only loads when it's used like all other vsh plugin modules (for picture, music, movie, etc.). Ie. when you click the icon.

[JumpR]

It's a vsh plugin so it only loads when it's used like all other vsh plugin modules (for picture, music, movie, etc.). Ie. when you click the icon.

I know, but I need to figure out when it's loaded, so that I can start locating and patching it once that happens, that's why I'm writing all the voodoo code.
I might've caused some confusion with my first post. All I want to do is figure out when sysconf loads, and the location of it.

[SilverSpring]

It's a vsh plugin so it only loads when it's used like all other vsh plugin modules (for picture, music, movie, etc.). Ie. when you click the icon.

I know, but I need to figure out when it's loaded, so that I can start locating and patching it once that happens, that's why I'm writing all the voodoo code.
I might've caused some confusion with my first post. All I want to do is figure out when sysconf loads, and the location of it.

The VSH uses scePaf_72A0044D to load/start the module. You can hook it and search for "flash0:/vsh/module/sysconf_plugin.prx" in it's second arg to know when it gets loaded.

[moonlight]

Well, for things like this is for what i export the function sctrlHENSetStartModuleHandler on the cfw, for dynamic patching :P

[JumpR]

It's a vsh plugin so it only loads when it's used like all other vsh plugin modules (for picture, music, movie, etc.). Ie. when you click the icon.

I know, but I need to figure out when it's loaded, so that I can start locating and patching it once that happens, that's why I'm writing all the voodoo code.
I might've caused some confusion with my first post. All I want to do is figure out when sysconf loads, and the location of it.

The VSH uses scePaf_72A0044D to load/start the module. You can hook it and search for "flash0:/vsh/module/sysconf_plugin.prx" in it's second arg to know when it gets loaded.

Thanks for the information, do you have a quick example on how to hook a function? I did several attempts with things like these

Code: Select all

#define MIPS_J_ADDRESS(x) (((u32)((x)) & 0x3FFcFFFFF) >> 2)
#define JAL_TO(x) (0x0E000000 | MIPS_J_ADDRESS(x))

Then attempting to patch the calls with that and _sw, but it didn't really work.
If you've got a (link to a) example, it'd be great, thanks for all the help so far!
I have partial MIPS knowledge and I'll be able to find the memory offsets I need, so that's not a problem.

[moonlight]

If you are in a kernel mode prx, you cannot hook a user function like that, not without endind with a crash.

[JumpR]

If you are in a kernel mode prx, you cannot hook a user function like that, not without endind with a crash.

I didn't notice your previous post till now, I downloaded the M33 SDK and found the sctrlHENSetStartModuleHandler, interesting function which I'll sure experiment with.
However, if I can't hook a user function from a kernel PRX, how would I go about doing that then? A user mode plugin isn't really a perfect solution as far as I know.
Thanks for the help.

[moonlight]

Well, better use that function I told you. It will advise your module whenever a module is about to start. You just have to compare mod->modname name with the one you are searching, and doing stuff in that case.

But be careful of using it correctly, calling the "previous" function if it exists, and setting the correct compiler flags (as indicated in function documentation) to avoid the compiler using the gp register.

[JumpR]

Well, better use that function I told you. It will advise your module whenever a module is about to start. You just have to compare mod->modname name with the one you are searching, and doing stuff in that case.

But be careful of using it correctly, calling the "previous" function if it exists, and setting the correct compiler flags (as indicated in function documentation) to avoid the compiler using the gp register.

Indeed will I use your function, but the question regarding the hooking of functions was apart from it.

Because, after detecting the module, I need to hook some functions in the module. I expected my old code to work, but you just posted that you can't hook user functions from a kernel PRX. Because of that, I'd better ask that seperate question here right now, rather then creating a new thread about it. After this, I should know everything I need to know.

Thanks for your time,
JumpR

[Hellcat]

Not sure if this really helps, but here's the code I use to hook syscalls:

Code: Select all

struct SyscallHeader 
{ 
  void *unk; 
  unsigned int basenum; 
  unsigned int topnum; 
  unsigned int size; 
};

u32 pspFindProc(const char* szMod, const char* szLib, u32 nid)
{
  struct SceLibraryEntryTable *entry;
	SceModule *pMod;
	void *entTab;
	int entLen;

	pMod = sceKernelFindModuleByName(szMod);

	if (!pMod)
	{
		// NOP //
		return 0;
	}
	
	int i = 0;

	entTab = pMod->ent_top;
	entLen = pMod->ent_size;
	
	while&#40;i < entLen&#41;
  &#123;
		int count;
		int total;
		unsigned int *vars;

		entry = &#40;struct SceLibraryEntryTable *&#41; &#40;entTab + i&#41;;

    if&#40;entry->libname && !strcmp&#40;entry->libname, szLib&#41;&#41;
		&#123;
			total = entry->stubcount + entry->vstubcount;
			vars = entry->entrytable;

			if&#40;entry->stubcount > 0&#41;
			&#123;
				for&#40;count = 0; count < entry->stubcount; count++&#41;
				&#123;
					if &#40;vars&#91;count&#93; == nid&#41;
					&#123;
				    return vars&#91;count+total&#93;;
				  &#125;					
				&#125;
			&#125;
		&#125;

		i += &#40;entry->len * 4&#41;;
	&#125;

	return 0;
&#125;

void* pspGetSysCallAddr&#40;u32 addr&#41; 
&#123; 
  struct SyscallHeader *head; 
  u32 *syscalls; 
  void **ptr; 
  int size; 
  int i; 

  asm&#40; 
    "cfc0 %0, $12\n" 
    &#58; "=r"&#40;ptr&#41; 
  &#41;; 

  if&#40;!ptr&#41; 
  &#123; 
    return NULL; 
  &#125; 

  head = &#40;struct SyscallHeader *&#41; *ptr; 
  syscalls = &#40;u32*&#41; &#40;*ptr + 0x10&#41;; 
  size = &#40;head->size - 0x10&#41;;

  for&#40;i = 0; i < size; i++&#41; 
  &#123; 
    if&#40;syscalls&#91;i&#93; == addr&#41; 
    &#123; 
      return &syscalls&#91;i&#93;; 
    &#125; 
  &#125; 

  return NULL; 
&#125;

// static
void* pspPatchProcCall&#40;u32 *addr, void *func&#41; 
&#123;
  if&#40;!addr&#41; 
  &#123; 
    return NULL; 
  &#125; 
  *addr = &#40;u32&#41; func; 
  sceKernelDcacheWritebackInvalidateRange&#40;addr, sizeof&#40;addr&#41;&#41;; 
  sceKernelIcacheInvalidateRange&#40;addr, sizeof&#40;addr&#41;&#41;; 

  return addr; 
&#125;

and call it (perform the actual hooking) with something like this:

Code: Select all

  oProcAddr = (void*)pspFindProc("sceIOFileManager", "IoFileMgrForUser", 0x109F50BC);
  pspPatchProcCall(pspGetSysCallAddr((u32)oProcAddr), &patchedIoOpen);
  oIoOpen = (void*)oProcAddr;

A bit OT, but:
Can anyone tell me in which .PRX is the code doing the memstick formattig when using the option in System-Config of the PSP?
I wanna check a few things in there....

[moonlight]

The process is really ugly :)

Well, user mode and kernel one comunicate between syscalls.
So, basically you have to set a syscall instruction in the point to hook, and make sure the syscall number will end in your code. You can have a syscall in your code by exporting a function to user mode, and the number of your syscall can be get using sceKernelQuerySystemCall(addr), where addr is the address of your function, although I'm not sure if in latest firmwares the syscall is inmediately assigned or if it assigned after having been imported at least once.
Another way would be just patching the address of an already registered syscall, and find a way of diferentiating the call to that function from the one to yours.

Another problem is that syscall don't have a delay slot, so when replacing a jal with a syscall instruction, you have to take care of that.

EDIT: well, someone replied first :p

[moonlight]

A bit OT, but:
Can anyone tell me in which .PRX is the code doing the memstick formattig when using the option in System-Config of the PSP?
I wanna check a few things in there....

The format itself is done through a fatms0 devctl, in concrete, the devctl code 0x0241d813, but i don't know the caller, maybe sysconf_plugin.

EDIT: yeah, it is, i saw the code.

Code: Select all

u32 x[1];
x[0] = 0;
vshIoDevctl("fatms0:",  0x0241d813,  &x, 4, NULL, 0);

(After last edit, this should be the correct code. I bet the "x" is really a structure with only one field that is set to 0/NULL.)

Probably requires kernel mode, that's why they are using vshIoDevctl.

[JumpR]

Thanks for all the help, much appreciated. I'll Google a bit for more information about syscalls and I should be fine.
Thanks!

[KickinAezz]

If you are in a kernel mode prx, you cannot hook a user function like that, not without endind with a crash.

:confused: I had no problems doing so in the past.

[JumpR]

Well, this just isn't going to work, I downloaded the M33 SDK and copied it to the pspdev directory (it's found by the compiler if I include it), and coded this in my attempt to dump the sysconf:

Code: Select all

#include <pspkernel.h>
#include <pspctrl.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <systemctrl.h>
#include <systemctrl_se.h>
PSP_MODULE_INFO&#40;"dump", 0x1000, 0, 1&#41;;		
PSP_MAIN_THREAD_ATTR&#40;0&#41;;
STMOD_HANDLER previous = NULL;
int OnModuleStart&#40;SceModule2 *mod&#41;;
int OnModuleStart&#40;SceModule2 *mod&#41;&#123;
	if &#40;strcmp&#40;mod->modname, "sysconf_plugin_module"&#41; == 0&#41;
	&#123;
		u32 *start = &#40;u32 *&#41;sceKernelFindModuleByName&#40;"sysconf_plugin_module"&#41;;
		u32 module = *&#40;start+27&#41;;
		int fd = sceIoOpen&#40;"ms0&#58;/dump.bin", PSP_O_WRONLY | PSP_O_CREAT | PSP_O_TRUNC, 0777&#41;;
		sceKernelDcacheWritebackAll&#40;&#41;;
		sceIoWrite&#40;fd, &#40;void*&#41; module, 0x030000&#41;;
		sceIoClose&#40;fd&#41;;
 	&#125;
	if &#40;!previous&#41; return 0;
	return previous&#40;mod&#41;;
&#125;
int main_thread&#40;SceSize args, void* argp&#41;
&#123;
	sceKernelDelayThread&#40;2000000&#41;;
	previous = sctrlHENSetStartModuleHandler&#40;OnModuleStart&#41;;
//	int fd = sceIoOpen&#40;"ms0&#58;/sysconf_dump.bin", PSP_O_WRONLY | PSP_O_CREAT | PSP_O_TRUNC, 0777&#41;;
//	sceIoWrite&#40;fd, &#40;void*&#41; module, 0x030000&#41;;
//	sceIoClose&#40;fd&#41;;
	return 0;
&#125;

int module_start&#40;SceSize args, void *argp&#41;
&#123;

	SceUID thid;
	thid = sceKernelCreateThread&#40;"ch_main", main_thread, 0x18, 0x1000, 0, NULL&#41;;
	if &#40;thid >= 0&#41; sceKernelStartThread&#40;thid, args, argp&#41;;
	return 0;
&#125;

int module_stop &#40;void&#41; &#123;
	return 0;
&#125;

Added the flag that I should add according to the SDK function doc and also added this:

Code: Select all

LIBS = -lpspsystemctrl_kernel

So, I attempted to compile, and it doesn't work.

Code: Select all

In file included from dump.c:6:
/usr/local/pspdev/lib/gcc/psp/4.1.0/../../../../psp/include/systemctrl.h:189: er
ror: expected ')' before '*' token
/usr/local/pspdev/lib/gcc/psp/4.1.0/../../../../psp/include/systemctrl.h:230: er
ror: expected '=', ',', ';', 'asm' or '__attribute__' before 'sctrlHENSetStartMo
duleHandler'
dump.c:10: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'previ
ous'
dump.c:11: error: expected ')' before '*' token
dump.c:12: error: expected ')' before '*' token
dump.c: In function 'main_thread':
dump.c:29: error: 'previous' undeclared (first use in this function)
dump.c:29: error: (Each undeclared identifier is reported only once
dump.c:29: error: for each function it appears in.)
dump.c:29: warning: implicit declaration of function 'sctrlHENSetStartModuleHand
ler'
dump.c:29: error: 'OnModuleStart' undeclared (first use in this function)

But I'm probably slowly moving into the newbie questions, so maybe I shouldn't ask them here, if so, tell me.

[moonlight]

If you are in a kernel mode prx, you cannot hook a user function like that, not without endind with a crash.

:confused: I had no problems doing so in the past.

You cannot jump from a user address to a kernel address directly. Another thing would be in 1.50, where a kernel static elf can be loaded in user memory.

[TyRaNiD]

Well if you need to get the syscall numbers allocated (and it doesn't do it for you at load time) you could always make a small user mode prx which you load the unload ;)

[JumpR]

Well if you need to get the syscall numbers allocated (and it doesn't do it for you at load time) you could always make a small user mode prx which you load the unload ;)

Thanks, but I currently can't even get the M33 SDK working, it keeps showing me errors like these:

Code: Select all

In file included from dump.c:6:
/usr/local/pspdev/lib/gcc/psp/4.1.0/../../../../psp/include/systemctrl.h:189: er
ror: expected ')' before '*' token
/usr/local/pspdev/lib/gcc/psp/4.1.0/../../../../psp/include/systemctrl.h:230: er
ror: expected '=', ',', ';', 'asm' or '__attribute__' before 'sctrlHENSetStartMo
duleHandler'
dump.c:10: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'previ
ous'
dump.c:11: error: expected ')' before '*' token
dump.c:12: error: expected ')' before '*' token
dump.c: In function 'main_thread':
dump.c:29: error: 'previous' undeclared (first use in this function)
dump.c:29: error: (Each undeclared identifier is reported only once
dump.c:29: error: for each function it appears in.)
dump.c:29: warning: implicit declaration of function 'sctrlHENSetStartModuleHand
ler'
dump.c:29: error: 'OnModuleStart' undeclared (first use in this function)

See my previous post for details. This is driving me crazy, if I recall I had this problem with hundreds of things I tried to compile, which I just stopped working on them for. I wish I could get this fixed by now.
My Makefile:

Code: Select all

TARGET = dump
OBJS = dump.o

USE_KERNEL_LIBC=1
USE_KERNEL_LIBS=1

PSP_FW_VERSION=371

PRX_EXPORTS=exports.exp

INCDIR = 
CFLAGS = -Os -G0 -Wall -fno-strict-aliasing -fno-builtin-printf -fno-pic
CXXFLAGS = $(CFLAGS) -fno-exceptions -fno-rtti
ASFLAGS = $(CFLAGS)

LIBDIR =
LIBS = -lpspsystemctrl_kernel
LDFLAGS = -mno-crt0 -nostartfiles

PSPSDK=/usr/local/pspdev/psp/sdk
include $(PSPSDK)/lib/build_prx.mak

Any clues?

[Mashphealh]

Well if you need to get the syscall numbers allocated (and it doesn't do it for you at load time) you could always make a small user mode prx which you load the unload ;)

Thanks, but I currently can't even get the M33 SDK working, it keeps showing me errors like these:

Code: Select all

In file included from dump.c:6:
/usr/local/pspdev/lib/gcc/psp/4.1.0/../../../../psp/include/systemctrl.h:189: er
ror: expected ')' before '*' token
/usr/local/pspdev/lib/gcc/psp/4.1.0/../../../../psp/include/systemctrl.h:230: er
ror: expected '=', ',', ';', 'asm' or '__attribute__' before 'sctrlHENSetStartMo
duleHandler'
dump.c:10: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'previ
ous'
dump.c:11: error: expected ')' before '*' token
dump.c:12: error: expected ')' before '*' token
dump.c: In function 'main_thread':
dump.c:29: error: 'previous' undeclared (first use in this function)
dump.c:29: error: (Each undeclared identifier is reported only once
dump.c:29: error: for each function it appears in.)
dump.c:29: warning: implicit declaration of function 'sctrlHENSetStartModuleHand
ler'
dump.c:29: error: 'OnModuleStart' undeclared (first use in this function)

See my previous post for details. This is driving me crazy, if I recall I had this problem with hundreds of things I tried to compile, which I just stopped working on them for. I wish I could get this fixed by now.
My Makefile:

Code: Select all

TARGET = dump
OBJS = dump.o

USE_KERNEL_LIBC=1
USE_KERNEL_LIBS=1

PSP_FW_VERSION=371

PRX_EXPORTS=exports.exp

INCDIR = 
CFLAGS = -Os -G0 -Wall -fno-strict-aliasing -fno-builtin-printf -fno-pic
CXXFLAGS = $(CFLAGS) -fno-exceptions -fno-rtti
ASFLAGS = $(CFLAGS)

LIBDIR =
LIBS = -lpspsystemctrl_kernel
LDFLAGS = -mno-crt0 -nostartfiles

PSPSDK=/usr/local/pspdev/psp/sdk
include $(PSPSDK)/lib/build_prx.mak

Any clues?

I get the same error if I use systemctrl.h :S .

[moonlight]

It maybe because in som version I forgto to include the modified psploadcore.h with "SceModule2" structure.

Try to add this at the beginning of file:

Code: Select all

typedef struct SceModule2 
{
	struct SceModule	*next; // 0
	u16					attribute; // 4
	u8					version[2]; // 6
	char				modname[27]; // 8
	char				terminal; // 0x23
	char				mod_state;	// 0x24
    char				unk1;    // 0x25
	char				unk2[2]; // 0x26
	u32					unk3;	// 0x28
	SceUID				modid; // 0x2C
	u32					unk4; // 0x30
	SceUID				mem_id; // 0x34
	u32					mpid_text;	// 0x38
	u32					mpid_data; // 0x3C
	void *				ent_top; // 0x40
	unsigned int		ent_size; // 0x44
	void *				stub_top; // 0x48
	u32					stub_size; // 0x4C
	u32					entry_addr_; // 0x50
	u32					unk5[4]; // 0x54
	u32					entry_addr; // 0x64
	u32					gp_value; // 0x68
	u32					text_addr; // 0x6C
	u32					text_size; // 0x70
	u32					data_size;	// 0x74
	u32					bss_size; // 0x78
	u32					nsegment; // 0x7C
	u32					segmentaddr[4]; // 0x80
	u32					segmentsize[4]; // 0x90
} SceModule2;

[JumpR]

It compiles now, time to start messing with it.
Thanks! =D

[Mashphealh]

Works perfect, thanks again moonlight ;)

[ne0h]

Excuse me,
can I use the "normal" sceIoDevctl in a kernel mode prx to format the ms?
Because I don't know where is defined vshIoDevctl function, I've found a stub file, but if I can I want to use standard library...

[Torch]

Excuse me,
can I use the "normal" sceIoDevctl in a kernel mode prx to format the ms?
Because I don't know where is defined vshIoDevctl function, I've found a stub file, but if I can I want to use standard library...

if ur in kernel mode then use sce function. usually vsh* style duplicates are for using the kernel version from user module, like xmb

[ab5000]

Excuse me,
can I use the "normal" sceIoDevctl in a kernel mode prx to format the ms?
Because I don't know where is defined vshIoDevctl function, I've found a stub file, but if I can I want to use standard library...

the vshIo* functions are just a bridge. they simply calls the kernel functions, so a user app can access them. if you are in kernel mode, you can use sceIo*.