Hi.
Today, while I was disassembling the Sony wlan driver (wlan.prx), i found a STRANGE string. It's "sceWlanChipInit" (0x00018F08, in the .rodata section of the prx). I jumped at the address where it's used (0x00003D30) and i found that the string is used as the first argument of sceKernelCreateThread (the name of the thread). I found the second argument (adress of the thread main function), i jumped at that address (0x00004A98) and i found the thread main function. I've written to a file the main routine and all the called routines etc.
Can this be useful? I can send the file. You can ask me it by PM.
Bye!
P.S. Sorry for my bad english!
sceWlanChipInit... can be useful?
I don't know if people around here will claim you as an hero or as evil itself (for some reasons other people searching for possible wlan tweaks -oriented to packet sniffing, of course- where treated in a very ugly way), but for me you are more the first one than the second! In both cases, you provided a clear and straight explanation of how functions are hunted in the FW jungle (at least one of the possible ways). Good work...Many thanks!!
Well, it's not useful as such, it just performs the hardware initialization of the wireless driver... If you want to compare, I have looked around 3.52 wlan.prx and got something like this:
Code: Select all
int _sceWlanPerformChipInit(SceWlanParam* config){
do{
ret = _sceWlanHWInit(config->hal);
if (ret < 0) return -1;
old_intr = sceKernelCpuSuspendIntr();
priority = (config->unk1&0x2000)?0x10:0x78;
th_id = sceKernelCreateThread("SceWlanChipInit", _sceWlanInitChipThread, priority, 0xC00, 0x100001, 0);
sceKernelCpuResumeIntr(old_intr);
config->chip_init_thid = th_id;
ret = sceKernelStartThread(th_id, 4, config);
if (ret != 0) return -1;
th_ret = sceKernelWaitThreadEnd(r17, 0);
if (th_ret == 0x800201AC){
sub_0000D1CC(config->hal, 0x80000002, 0);
}
sceKernelDeleteThread(th_id);
config->chip_init_thid = 0;
} while(th_ret == 1);
return th_ret;
}
//...
int _sceWlanInitChipThread(int args, void* argv){
SceWlanParam *config = argv[0]; // r16
r4 = config->hal;
ret = *(config->hal.unkc0)(config->hal);
if (ret < 0){
th_ret = 1;
} else {
*(r29+0x0) = 0;
*(r29+0x4) = 0;
*(r29+0x8) = 0;
*(r29+0xc) = 0;
*(r29+0x10) = 0;
sub_0000D1CC(config->hal, 0x201, r29);
hal->unkb8 = *(r29+0x6);
hal->region = _sceWlanGetWlanRegion();
ret = sub_00001224(config);
th_ret = (ret < 0)?1:0;
}
sceKernelExitThread(th_ret);
return 0;
}
int _sceWlanGetWlanRegion(void){
u16 tmp16;
ret = sceIdStorageLookup(0x45, 0, &tmp16, 2);
if (ret != 0) return 0x10<<8;
if (tmp16&0xFFF == 1) return 0x10<<8;
if (tmp16 == 0) return 0x10<<8;
if (tmp16&0xFFF == 2) return 0x30<<8;
if (tmp16&0xFFF == 3) return 0x40<<8;
return 0x10<<8;
}
//some internal ioctls probably...
int sub_0000D1CC(SceWlanHal *hal, int command, void* buf){
if (hal->unk0&1 == 0) return 0x80410D0C;
if ((command == 0x202) && (*(u32*)(buf+0) == 1)){
ret = _sceWlanHWInit(hal);
switch(ret){
case 0: return 0;
case -1:
default: return 0x80410D0D;
}
}
if (command == 0x80000002){
sceKernelSignalSema(hal->mshostlocksema, 1);
}
if (command == 0x201){
*(u16*)(buf+0) = hal->unk78;
*(u16*)(buf+2) = hal->unk7A;
*(u16*)(buf+4) = hal->unk7C;
}
if (hal->unkd0 == 0) return 0x80410D0E;
ret = *(hal->unkd0)(hal, command, buf);
switch(ret){
case 0: return 0;
case -1: return 0x80410D0D;
case -2: return 0x80410D04;
case -3: return 0x80410D11;
case -4: return 0x80410D0D;
case -5: int* message = 0x0001A150;
message[2] = 0xC0000000;
if (message[6]&1 == 0){
message[6] = 3;
sceKernelSendMbx(hal->g_config->mac_mbx, message);
}
return 0x80410D0C;
case -6: return 0x80410D84;
case -7: return 0x80410D85;
default: return 0x80410D0D;
}
}By doing some RE on wlan.prx... I didn't find many elements, though. Anyways, you'd be better off looking in the direction of the HAL. Here's my module_start code, btw:
As you can see in the following code, starting from "unkb8" of the HAL param struct, there are some callbacks which might be worth investigating if you're searching to do packet capture.
Code: Select all
int module_start(void){
SceWlanParam *wlan_conf = 0;
u16 tmp16;
u8 tmp16_1,tmp16_2;
old_k1 = pspSetK1(pspGetK1()>>16);
if (g_WlanConf != 0){
pspSetK1(old_k1);
return 1;
}
g_heap = _sceWlanCreateHeap(0xE800);
if (g_heap < 0){
pspSetK1(old_k1);
return 1;
}
ret = sceKernelAllocateVpl(g_heap, 0x1f0, wlan_conf, 0);
wlan_conf = (ret == 0)?wlan_conf:0;
if (wlan_conf == 0){
pspSetK1(old_k1);
return 1;
}
memset(wlan_conf, 0, 0x1f0);
wlan_conf->main_heap = g_heap;
wlan_conf->unk1d0 = 0x10000;
wlan_conf->iflock_sema = sceKernelCreateSema("SceWlanMacIfLock", 0x101, 1, 1, 0);
wlan_conf->mac_mbx = sceKernelCreateMbx("SceWlanMac", 1, 0);
_sceWlanDWZero(&wlan_conf->unk1b0);
_sceWlanDWZero(&wlan_conf->unk1b8);
wlan_conf->unk1ptr = _sceWlanVplAlloc(wlan_conf, 0x79E0);
memset(wlan_conf->unk1ptr, 0, 0x79E0);
for(i = 0x13; i >= 0; i--){
wlan_conf->unk1ptr->index[i].unk0 = 0;
wlan_conf->unk1ptr->index[i].next = wlan_conf->unk1ptr->index[i+1];
wlan_conf->unk1ptr->index[i].data_ptr = wlan_conf->unk1ptr->data[i];
}
wlan_conf->unk1ptr->index[i].next = wlan_conf->unk1ptr.index[0];
wlan_conf->unk1_datasize = 0x604;
wlan_conf->unk1_count = 0x14;
wlan_conf->unk1ptr_2 = wlan_conf->unk1ptr;
wlan_conf->unk1c0 = _sceWlanVplAlloc(param_base, 0x93A);
wlan_conf->unk2ptr = _sceWlanVplAlloc(param_base, 0xC8);
for(i = 0; i < 0x18; i++){
wlan_conf->unk2ptr->index[i].unk1 = 0;
wlan_conf->unk2ptr->index[i].unk2 = 0;
wlan_conf->unk2ptr->index[i].next = wlan_conf->unk2ptr->index[i+1];
}
wlan_conf->unk2ptr->index[i].unk1 = 0;
wlan_conf->unk2ptr->index[i].unk2 = 0;
wlan_conf->unk2ptr->index[i].next = wlan_conf->unk2ptr->index[0];
wlan_conf->unk1ec = 0x32;
*(wlan_conf->unk158) = *(wlan_conf->unk158) | 2;
wlan_conf->unk158 = wlan_conf->unk154;
wlan_conf->unk1e4 = 0x8;
wlan_conf->unk1e8 = 0xF;
ret = sceIdStorageLookup(0x45, 0, &tmp16, 2);
if (ret < 0){
wlan_conf->unk1d4 = 0;
} else {
wlan_conf->unk1d4 = tmp16 & 0xF000;
}
ret1 = sceIdStorageLookup(0x45, 3, &tmp8_1, 1);
ret2 = sceIdStorageLookup(0x45, 4, &tmp8_2, 1);
if ((ret1 >= 0) && (tmp8_1 == 1) && (ret2 >= 0) ){
wlan_conf->unk1d6 = 0xF;
wlan_conf->unk1d7 = tmp8_2;
} else {
wlan_conf->unk1d6 = 0;
}
if ((wlan_conf->unk1d4 == 0x1000) && (wlan_conf->unk1d6 != 1)){
wlan_conf->unk1d6 = 1;
wlan_conf->unk1d7 = 2;
}
_sceWlanSetupParam(wlan_conf);
_sceWlanStartMacThread(wlan_conf);
sceKernelRegisterSysEventHandler(0x000197D0);
g_WlanConf = wlan_conf;
pspSetK1(old_k1);
return 0;
}Code: Select all
struct SceWlanParam{
u32 unk0;
u32 unk4;
u32 unk8;
u32 unkc;
u32 unk10;
u32 unk14;
u32 unk18;
u32 unk1c;
u32 unk20;
u32 unk24;
u32 unk28;
u32 unk2c;
u32 unk30;
u32 unk34;
u32 unk38;
u32 unk3c;
u32 unk40;
u32 unk44;
u32 unk48;
u32 unk4c;
u32 unk50;
u32 unk54;
u32 unk58;
u32 unk5c;
u32 unk60;
u32 unk64;
u32 unk68;
u32 unk6c;
u32 unk70;
u32 unk74;
u32 unk78;
u32 unk7c;
u32 unk80;
u32 unk84;
u32 unk88;
u32 unk8c;
u32 unk90;
u32 unk94;
u32 unk98;
u32 unk9c;
u32 unka0;
u32 unka4;
u32 unka8;
u32 unkac;
u16 unkb0;
u16 unkb2;
u32 unkb4;
u32 unkb8;
u32 unkbc;
u32 unkc0;
u32 unkc4;
u16 unkc8;
u16 unkca;
u8 unkcc;
u8 unkcd;
u16 unkce;
u16 unkd0;
u16 unkd2;
u32 unkd4;
u32 unkd8;
u32 unkdc;
u32 unke0;
u32 unke4;
u32 unke8;
u32 unkec;
u32 unkf0;
u32 unkf4;
u32 unkf8;
u32 unkfc;
u32 unk100;
u32 unk104;
u32 unk108;
u32 unk10c;
u32 unk110;
u32 unk114;
u32 unk118;
u32 unk11c;
u32 unk120;
u32 unk124;
u32 unk128;
u32 unk12c;
u32 unk130;
u32 unk1_datasize; //134
u32 unk1_count; //138
SceWlanUnk1 *unk1ptr; //13c
SceWlanUnk1 *unk1ptr_2; //140
u32 unk144;
u32 unk148;
u32 unk14c;
u32 unk150;
SceWlanUnk2 *unk2ptr; //154
u32 unk158;
u32 unk15c;
u32 unk160;
u32 unk164;
u32 mac_thid
u32 chip_init_thid; //0x16C
u32 iflock_sema; //0x170
u32 mac_mbx; //0x174
u32 main_heap; //0x178
u32 unk17c;
SceWlanHalStruct *hal; //0x180
u32 unk184;
u32 unk188;
u32 unk18c;
u32 unk190;
u32 unk194;
u32 unk198;
u32 unk19c;
u32 unk1a0;
u32 unk1a4;
u32 unk1a8;
u32 unk1ac;
u32 unk1b0;
u32 unk1b4;
u32 unk1b8;
u32 unk1bc;
u32 unk1c0;
u32 unk1c4;
u32 unk1c8;
u32 unk1cc;
u32 unk1d0;
u16 unk1d4;
u8 unk1d6;
u8 unk1d7;
u32 unk1d8;
u32 unk1dc;
u32 unk1e0;
u32 unk1e4;
u32 unk1e8;
u32 unk1ec;
}
================================================================
struct SceWlanUnk1{
SceWlanUnk1Index index[0x14];
SceWlanUnk1Data data[0x14];
}
struct SceWlanUnk1Index{
int unk1;
SceWlanUnk1Index *next;
int unk3;
int unk4;
int data_ptr
}
struct SceWlanUnk1Data{
u8 data[0x604];
}
================================================================
struct SceWlanUnk2{
SceWlanUnk2Index index[0x19];
}
struct SceWlanUnk2Index{
u16 unk1;
u16 unk2;
SceWlanUnk2Index *next;
}
================================================================
struct SceWlanHWAccess{
u32 mshostlocksema; //c
u32 ev_flag; //10
u32 reg01; //14
u32 reg02; //18
u32 reg03; //1c
u32 reg04; //20
u32 reg05; //24
u32 reg06; //28
u32 reg07; //2c
u32 reg08; //30
u32 reg09; //34
u32 reg10; //38
u32 reg11; //3c
u32 reg12; //40
u32 reg13; //44
u32 reg14; //48
u32 reg15; //4c
u32 reg16; //50
u32 reg17; //54
u32 reg18; //58
u32 reg19; //5c
u32 reg20; //60
u32 reg21; //64
}
================================================================
struct SceWlanHal{
u32 unk0;
u32 unk4;
u32 unk8;
SceWlanHWAccess hw;
u32 unk68;
u32 unk6c;
u32 unk70;
u32 unk74;
//
u16 unk78;
u16 unk7a;
u16 unk7c;
u16 unk7e;
u32 unk80;
u32 unk84;
u32 unk88;
u32 unk8c;
u32 unk90;
u32 unk94;
u32 unk98;
u32 unk9c;
u32 unka0;
u32 unka4;
u32 unka8;
u32 unkac;
u16 region; //b0
u16 unkb2;
//u16 unkb4 + u16 unkb6??
u32 unkb4;
//callbacks start?
u32 unkb8;
u32 unkbc;
u32 unkc0;
u32 unkc4;
u32 unkc8;
u32 unkcc;
u32 unkd0;
u32 unkd4;
u32 unkd8;
u32 unkdc;
u32 unke0;
u32 unke4;
//callbacks end?
u32 dma_op; //e8
u32 unkbuf80; //ec
u32 unkf0;
u32 hal_thid; //f4
u32 mshostlockflag; //f8
u32 mbx; //fc
SceWlanParam *g_config; //100
void* buf1; //104
void* buf2; //108
u32 unk10c;
u32 unk110;
u32 unk114;
u32 unk118;
u32 unk11c;
u32 unk120;
u32 unk124;
u32 unk128;
u32 unk12c;
u32 unk130;
u32 unk134;
u32 unk138;
u32 unk13C;
u32 unk140;
u32 unk144;
u32 unk148;
u32 unk14c;
u32 unk150;
u32 unk154;
u32 unk158;
u32 unk15c;
u32 unk160;
u32 unk164;
u32 unk160;
u32 unk16c;
u32 unk170;
u32 unk174;
u32 unk178;
u32 unk17c;
u32 unk180;
u32 unk184;
u32 unk188;
u32 unk18c;
u32 unk190;
u32 unk194;
u32 unk198;
u32 unk19c;
u32 unk1a0;
u32 unk1a4;
u32 unk1a8;
u32 unk1ac;
u32 unk1b0;
}-
KickinAezz
- Posts: 328
- Joined: Sun Jun 03, 2007 10:05 pm