├── .gitattributes ├── .gitignore ├── PKG └── DYNA00001 │ ├── ICON0.PNG │ └── PARAM.SFO ├── README.md ├── TEST.bat ├── core.c ├── core.h ├── data ├── keys ├── ldr_curves └── vsh_curves ├── htab_payload.h ├── main.c ├── make-pkg.bat ├── make.bat ├── makefile ├── patch421 ├── fw_table421.h ├── hvcall421.c ├── hvcall421.h ├── patch421.c └── patch421.h ├── patch421dex ├── fw_table421dex.h ├── hvcall421dex.c ├── hvcall421dex.h ├── patch421dex.c └── patch421dex.h ├── stuff ├── FullRamdumper │ ├── Makefile │ ├── core.c │ ├── core.h │ ├── main.c │ └── make.bat ├── htab-dumper │ ├── 421-dex-htab-F000000 │ │ └── PS3_HTAB.bin │ ├── Makefile │ ├── core.c │ ├── core.h │ ├── main.c │ └── make.bat └── hvcall-htab-fix-permissions │ ├── Makefile │ ├── common.h │ ├── core.c │ ├── core.h │ ├── hvcall.c │ ├── hvcall.h │ ├── main.c │ └── make.bat └── tools ├── APP.conf ├── cygwin1.dll ├── psn_package_npdrm.exe ├── scetool.exe └── zlib1.dll /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | 4 | # Custom for Visual Studio 5 | *.cs diff=csharp 6 | *.sln merge=union 7 | *.csproj merge=union 8 | *.vbproj merge=union 9 | *.fsproj merge=union 10 | *.dbproj merge=union 11 | 12 | # Standard to msysgit 13 | *.doc diff=astextplain 14 | *.DOC diff=astextplain 15 | *.docx diff=astextplain 16 | *.DOCX diff=astextplain 17 | *.dot diff=astextplain 18 | *.DOT diff=astextplain 19 | *.pdf diff=astextplain 20 | *.PDF diff=astextplain 21 | *.rtf diff=astextplain 22 | *.RTF diff=astextplain 23 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | ################# 2 | ## Eclipse 3 | ################# 4 | 5 | *.pydevproject 6 | .project 7 | .metadata 8 | bin/ 9 | tmp/ 10 | *.tmp 11 | *.bak 12 | *.swp 13 | *~.nib 14 | local.properties 15 | .classpath 16 | .settings/ 17 | .loadpath 18 | 19 | # External tool builders 20 | .externalToolBuilders/ 21 | 22 | # Locally stored "Eclipse launch configurations" 23 | *.launch 24 | 25 | # CDT-specific 26 | .cproject 27 | 28 | # PDT-specific 29 | .buildpath 30 | 31 | 32 | ################# 33 | ## Visual Studio 34 | ################# 35 | 36 | ## Ignore Visual Studio temporary files, build results, and 37 | ## files generated by popular Visual Studio add-ons. 38 | 39 | # User-specific files 40 | *.suo 41 | *.user 42 | *.sln.docstates 43 | 44 | # Build results 45 | [Dd]ebug/ 46 | [Rr]elease/ 47 | *_i.c 48 | *_p.c 49 | *.ilk 50 | *.meta 51 | *.obj 52 | *.pch 53 | *.pdb 54 | *.pgc 55 | *.pgd 56 | *.rsp 57 | *.sbr 58 | *.tlb 59 | *.tli 60 | *.tlh 61 | *.tmp 62 | *.vspscc 63 | .builds 64 | *.dotCover 65 | 66 | ## TODO: If you have NuGet Package Restore enabled, uncomment this 67 | #packages/ 68 | 69 | # Visual C++ cache files 70 | ipch/ 71 | *.aps 72 | *.ncb 73 | *.opensdf 74 | *.sdf 75 | 76 | # Visual Studio profiler 77 | *.psess 78 | *.vsp 79 | 80 | # ReSharper is a .NET coding add-in 81 | _ReSharper* 82 | 83 | # Installshield output folder 84 | [Ee]xpress 85 | 86 | # DocProject is a documentation generator add-in 87 | DocProject/buildhelp/ 88 | DocProject/Help/*.HxT 89 | DocProject/Help/*.HxC 90 | DocProject/Help/*.hhc 91 | DocProject/Help/*.hhk 92 | DocProject/Help/*.hhp 93 | DocProject/Help/Html2 94 | DocProject/Help/html 95 | 96 | # Click-Once directory 97 | publish 98 | 99 | # Others 100 | [Bb]in 101 | [Oo]bj 102 | sql 103 | TestResults 104 | *.Cache 105 | ClientBin 106 | stylecop.* 107 | ~$* 108 | *.dbmdl 109 | Generated_Code #added for RIA/Silverlight projects 110 | 111 | # Backup & report files from converting an old project file to a newer 112 | # Visual Studio version. Backup files are not needed, because we have git ;-) 113 | _UpgradeReport_Files/ 114 | Backup*/ 115 | UpgradeLog*.XML 116 | 117 | 118 | 119 | ############ 120 | ## Windows 121 | ############ 122 | 123 | # Windows image file caches 124 | Thumbs.db 125 | 126 | # Folder config file 127 | Desktop.ini 128 | 129 | 130 | ############# 131 | ## Python 132 | ############# 133 | 134 | *.py[co] 135 | 136 | # Packages 137 | *.egg 138 | *.egg-info 139 | dist 140 | build 141 | eggs 142 | parts 143 | bin 144 | var 145 | sdist 146 | develop-eggs 147 | .installed.cfg 148 | 149 | # Installer logs 150 | pip-log.txt 151 | 152 | # Unit test / coverage reports 153 | .coverage 154 | .tox 155 | 156 | #Translations 157 | *.mo 158 | 159 | #Mr Developer 160 | .mr.developer.cfg 161 | 162 | # Mac crap 163 | .DS_Store 164 | -------------------------------------------------------------------------------- /PKG/DYNA00001/ICON0.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/IngPereira/DynarecPS3/bd36250e2e0391cc90fccbc292f755f466e4d827/PKG/DYNA00001/ICON0.PNG -------------------------------------------------------------------------------- /PKG/DYNA00001/PARAM.SFO: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/IngPereira/DynarecPS3/bd36250e2e0391cc90fccbc292f755f466e4d827/PKG/DYNA00001/PARAM.SFO -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | DynarecPS3 2 | ========== 3 | 4 | Homebrew tool loading patches on to LV2 allowing dynamic recompiler code support on PS3 GameOS. 5 | 6 | The tool make possible running JIT code on GameOS PS3 by loading patches to lv2, using peek | poke lv2 calls based in some codes from libkammy stuff on 3.41, right now just work on cfw 4.21 DEX or CEX, it need to be ported to others CFW. 7 | 8 | It can be ported too to work on MFW (implementation on lv2_kernel.self, see bugs) 9 | 10 | if anyone need help with porting to MFW (LV2_KERNEL) like cfw ps3ita or Rebug so have dynarec support patched without any pkg or lv2 patcher, just try to send me a pm or email. 11 | 12 | Usage 13 | ========== 14 | 15 | Just run the tool, it will beep and leave a log in /dev_hdd0/APP.log. 16 | 17 | Actually the tool make a .log (/dev_hdd0/APP.log) with some info if there are errors with the patches, i made this right now because this can help a lot in the porting process as right now just work on 4.21 dex and the patches when are wrong can actually make appear a black screen so again this can speed up the porting. 18 | 19 | Notes 20 | ========== 21 | 22 | Bugs known: 23 | 24 | .- Cannot install pkgs, error 0x80029F0A , because this is recommended right now to use this only when is needed (Before running any emulator for example) and if you have previusly installed what do you need later. 25 | 26 | Building 27 | ========== 28 | 29 | Building requires PS3 SDK right now, included are some batch stuff to help in the compile stuff by using MSYS properly installed. 30 | 31 | Porting 32 | ========== 33 | 34 | Right now it can support any cfw just need rights offsets to work good, by now just use lv1 poke to patch 35 | lv2 protection and later it use hv call lv1_write_htab_entry (so it install hvsc redirect to call hvcalls) 36 | to apply execution permissions on high area of lv2 0x700000 so we can put executable piece of code right there and apply the right patches that make possible running dynamic recompilers code on PS3 GameOS LV2. 37 | 38 | It can work too again by patching lv2_kernel just need to relocate the htab payload address and apply permissions by modifying lv2_kernel.self segments page or in a more easy way by relocating branches of htab_payload to fit it in other space with good execution access known on lv2. 39 | 40 | This SOFTWARE is not licensed, approved or endorsed by "Sony Computer Entertainment, Inc." (SCEI), SNEI, 41 | SEN or any other party. 42 | -------------------------------------------------------------------------------- /TEST.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | make.exe 3 | del EBOOT.self 4 | RD objs /S /Q 5 | tools\scetool.exe --self-app-version=0001000000000000 --sce-type=SELF --compress-data=TRUE --self-add-shdrs=TRUE --skip-sections=FALSE --key-revision=1 --self-auth-id=1010000001000003 --self-vendor-id=01000002 --self-type=APP --self-fw-version=0003004000000000 --self-ctrl-flags 4000000000000000000000000000000000000000000000000000000000000002 --self-cap-flags 00000000000000000000000000000000000000000000007B0000000100000000 --encrypt EBOOT.ELF EBOOT.BIN 6 | pause 7 | -------------------------------------------------------------------------------- /core.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #include "core.h" 8 | 9 | int log = -1; 10 | 11 | int RebootShutdownMachine(int command) 12 | { 13 | system_call_3(379, command, 0, 0); 14 | return_to_user_prog(uint64_t); 15 | } 16 | 17 | int lv2FsChMode(char* path, int mode) 18 | { 19 | system_call_2(FILE_SYSTEM_CHMOD, (uint64_t)path, (uint64_t)mode); 20 | return_to_user_prog(uint64_t); 21 | } 22 | 23 | int lv2FsOpen(const char* path, uint64_t flags, int* fd, uint64_t special, const void* arg, uint64_t size) 24 | { 25 | system_call_6(FILE_SYSTEM_OPEN, (uint64_t)path, flags, (uint64_t)fd, special, (uint64_t)arg, size); 26 | return_to_user_prog(uint64_t); 27 | } 28 | 29 | int lv2FsRead(int fd, char* buffer, uint64_t size, uint64_t* bytes) 30 | { 31 | uint64_t temp_bytes; 32 | 33 | system_call_4(FILE_SYSTEM_READ, (uint64_t)fd, (uint64_t)buffer, size, !bytes ? (uint64_t)&temp_bytes : (uint64_t)bytes); 34 | return_to_user_prog(uint64_t); 35 | } 36 | 37 | int lv2FsWrite(int fd, void* buffer, uint64_t size, uint64_t* bytes) 38 | { 39 | uint64_t temp_bytes; 40 | 41 | system_call_4(FILE_SYSTEM_WRITE, (uint64_t)fd, (uint64_t)buffer, size, !bytes ? (uint64_t)&temp_bytes : (uint64_t)bytes); 42 | return_to_user_prog(uint64_t); 43 | } 44 | 45 | int lv2FsClose(int fd) 46 | { 47 | system_call_1(FILE_SYSTEM_CLOSE, (uint64_t)fd); 48 | return_to_user_prog(uint64_t); 49 | } 50 | 51 | int lv2FsOpenDir(const char* path, int* fd) 52 | { 53 | int result = ERROR_KERNEL_INVALID_MEMORY; 54 | if(path && fd) 55 | { 56 | system_call_2(FILE_SYSTEM_OPENDIR, (uint64_t)path, (uint64_t)fd); 57 | return_to_user_prog(uint64_t); 58 | } 59 | 60 | return result; 61 | } 62 | 63 | int lv2FsCloseDir(int fd) 64 | { 65 | system_call_1(FILE_SYSTEM_CLOSEDIR, (uint64_t)fd); 66 | return_to_user_prog(uint64_t); 67 | } 68 | 69 | int lv2FsUnLink(const char* path) 70 | { 71 | system_call_1(FILE_SYSTEM_UNLINK, (uint64_t)path); 72 | return_to_user_prog(uint64_t); 73 | } 74 | 75 | int lv2FsLseek(int fd, int64_t offset, int whence, uint64_t *pos) 76 | { 77 | if(pos) 78 | { 79 | system_call_4(FILE_SYSTEM_LSEEK, (uint64_t)fd, (uint64_t)offset, (uint64_t)whence, (uint64_t)pos); 80 | return_to_user_prog(uint64_t); 81 | } 82 | 83 | return ERROR_KERNEL_INVALID_MEMORY; 84 | } 85 | 86 | int lv2FsFSync(int fd) 87 | { 88 | system_call_1(FILE_SYSTEM_FSYNC, (uint64_t)fd); 89 | return_to_user_prog(uint64_t); 90 | } 91 | 92 | void WriteLogInit(uint32_t close, const char* unit, const char *fmt, ...) 93 | { 94 | int err; 95 | va_list list; 96 | char msg[256]; 97 | 98 | if(log == -1 && unit) 99 | { 100 | sprintf(msg, "%s/APP.log", unit); 101 | lv2FsUnLink(msg); 102 | err = lv2FsOpen(msg,CELL_FS_O_RDWR | CELL_FS_O_CREAT | LV2_O_APPEND, &log, CELL_FS_DEFAULT_CREATE_MODE_6, 0, 0); 103 | lv2FsChMode(msg, S_IFMT | 0777); 104 | if(err != CELL_OK) 105 | { 106 | log = -1; 107 | return; 108 | } 109 | } 110 | 111 | va_start(list, fmt); 112 | vsprintf(msg, fmt, list); 113 | va_end(list); 114 | 115 | if(log != -1) 116 | { 117 | lv2FsWrite(log, msg, strlen(msg), NULL); 118 | lv2FsFSync(log); 119 | if(close) 120 | { 121 | lv2FsClose(log); 122 | log = -1; 123 | } 124 | } 125 | } 126 | 127 | int lv2_sm_ring_buzzer(uint64_t unknown1, uint8_t unknown2, uint32_t unknown3) 128 | { 129 | system_call_3(392, unknown1, unknown2, unknown3); 130 | return_to_user_prog(uint64_t); 131 | } 132 | 133 | uint64_t lv1Peek(uint64_t addr) 134 | { 135 | system_call_1(PEEKLV1, addr); 136 | return_to_user_prog(uint64_t); 137 | } 138 | 139 | void lv1Poke(uint64_t addr, uint64_t opcode) 140 | { 141 | system_call_2(POKELV1, addr, opcode); 142 | } 143 | 144 | uint64_t lv2peek(uint64_t addr) 145 | { 146 | system_call_1(6, addr); 147 | return_to_user_prog(uint64_t); 148 | } 149 | 150 | void lv2poke(uint64_t addr, uint64_t val) 151 | { 152 | system_call_2(7, addr, val); 153 | } 154 | 155 | void pokeq32(uint64_t addr, uint32_t val) 156 | { 157 | uint32_t next = lv2peek(addr) & 0xffffffff; 158 | lv2poke(addr, (uint64_t) val << 32 | next); 159 | } 160 | 161 | void _poke(uint64_t addr, uint64_t val) 162 | { 163 | lv2poke(0x8000000000000000ULL + addr, val); 164 | } 165 | 166 | void _poke32(uint64_t addr, uint32_t val) 167 | { 168 | pokeq32(0x8000000000000000ULL + addr, val); 169 | } 170 | -------------------------------------------------------------------------------- /core.h: -------------------------------------------------------------------------------- 1 | 2 | #define PEEKLV1 8 3 | #define POKELV1 9 4 | #define LV1_GET_VERSION_INFO 0x7F 5 | #define LV1_PANIC 0xFF 6 | #define GET_SYSTEM_PARAMETER 0x17C 7 | #define DEVICE_SERVICE_SYSTEM_RETRIEVER 0x363 8 | #define DEVICE_GET_PS_CODE_COMMAND 0x19004 9 | 10 | #define CELL_FS_SEEK_SET SEEK_SET 11 | #define CELL_FS_SEEK_CUR SEEK_CUR 12 | #define CELL_FS_SEEK_END SEEK_END 13 | 14 | #define REBOOT 0x200 15 | #define SHUTDOWN 0x100 16 | 17 | #define S_IFMT 00170000 18 | #define LV2_O_RDONLY 0 19 | #define LV2_O_WRONLY 1 20 | #define LV2_O_RDWR 2 21 | #define LV2_O_ACCMODE 3 22 | #define LV2_O_CREAT 100 23 | #define LV2_O_EXCL 200 24 | #define LV2_O_TRUNC 1000 25 | #define LV2_O_APPEND 2000 26 | #define LV2_O_MSELF 10000 27 | #define CELL_FS_O_RDONLY 0 28 | #define CELL_OK 0 29 | #define CELL_FS_O_RDWR 2 30 | #define CELL_FS_O_CREAT 100 31 | #define CELL_FS_DEFAULT_CREATE_MODE_6 0x186 32 | 33 | #define FILE_SYSTEM_OPEN 801 34 | #define FILE_SYSTEM_READ 802 35 | #define FILE_SYSTEM_WRITE 803 36 | #define FILE_SYSTEM_CLOSE 804 37 | #define FILE_SYSTEM_OPENDIR 805 38 | #define FILE_SYSTEM_READDIR 806 39 | #define FILE_SYSTEM_CLOSEDIR 807 40 | #define FILE_SYSTEM_STAT 808 41 | #define FILE_SYSTEM_MKDIR 811 42 | #define FILE_SYSTEM_FSTAT 809 43 | #define FILE_SYSTEM_UNLINK 814 44 | #define FILE_SYSTEM_LSEEK 818 45 | #define FILE_SYSTEM_FSYNC 820 46 | #define FILE_SYSTEM_MOUNT 837 47 | #define FILE_SYSTEM_UNMOUNT 838 48 | #define FILE_SYSTEM_CHMOD 834 49 | #define FLASH1 1 50 | #define FLASH2 2 51 | #define FLASH3 3 52 | #define FLASH4 4 53 | #define WRITE_NO_PROTECTED 0 54 | #define WRITE_PROTECTED 1 55 | #define MAX_USB_RETRY_MOUNT 5 56 | #define RAW_MODE 1 57 | #define NORMAL_MODE 0 58 | 59 | #define ERROR_KERNEL_509 0x80010509 60 | #define ERROR_KERNEL_CANT_ALLOC_MEMORY 0x80010004 61 | #define ERROR_KERNEL_INVALID_ARGUMENT 0x80010002 62 | #define ERROR_KERNEL_IOERROR 0x8001002B 63 | #define ERROR_KERNEL_NO_RESOURCE 0x80010005 64 | #define ERROR_KERNEL_INVALID_MEMORY 0x8001000D 65 | #define ID_NOR 0x100000200000004 66 | 67 | int RebootShutdownMachine(int command); 68 | int lv2FsChMode(char* path, int mode); 69 | int lv2FsOpen(const char* path, uint64_t flags, int* fd, uint64_t special, const void* arg, uint64_t size); 70 | int lv2FsRead(int fd, char* buffer, uint64_t size, uint64_t* bytes); 71 | int lv2FsWrite(int fd, void* buffer, uint64_t size, uint64_t* bytes); 72 | int lv2FsClose(int fd); 73 | int lv2FsOpenDir(const char* path, int* fd); 74 | int lv2FsCloseDir(int fd); 75 | int lv2FsUnLink(const char* path); 76 | int lv2FsLseek(int fd, int64_t offset, int whence, uint64_t *pos); 77 | int lv2FsFSync(int fd); 78 | void WriteLogInit(uint32_t close, const char* unit, const char *fmt, ...); 79 | int lv2_sm_ring_buzzer(uint64_t unknown1, uint8_t unknown2, uint32_t unknown3); 80 | uint64_t lv1Peek(uint64_t addr); 81 | void lv1Poke(uint64_t addr, uint64_t opcode); 82 | uint64_t lv2peek(uint64_t addr); 83 | void lv2poke(uint64_t addr, uint64_t val); 84 | void pokeq32(uint64_t addr, uint32_t val); 85 | void _poke(uint64_t addr, uint64_t val); 86 | void _poke32(uint64_t addr, uint32_t val); 87 | -------------------------------------------------------------------------------- /data/keys: -------------------------------------------------------------------------------- 1 | [NP_tid] 2 | type=OTHER 3 | key=9B515FEACF75064981AA604D91A54E97 4 | 5 | [NP_ci] 6 | type=OTHER 7 | key=6BA52976EFDA16EF3C339FB2971E256B 8 | 9 | [NP_klic_free] 10 | type=OTHER 11 | key=72F990788F9CFF745725F08E4C128387 12 | 13 | [NP_klic_key] 14 | type=OTHER 15 | key=F2FBCA7A75B04EDC1390638CCDFDD1EE 16 | 17 | [NP_idps_const] 18 | type=OTHER 19 | key=5E06E04FD94A71BF0000000000000001 20 | 21 | [NP_rif_key] 22 | type=OTHER 23 | key=DA7D4B5E499A4F53B1C1A14A7484443B 24 | 25 | [NP_sig] 26 | type=OTHER 27 | pub=E6792E446CEBA27BCADF374B99504FD8E80ADFEB3E66DE73FFE58D3291221C65018C038D3822C3C9 28 | priv=000000000000000000000000000000000000000000 29 | ctype=2 30 | 31 | [pkg] 32 | type=PKG 33 | revision=00 34 | version=0003005500000000 35 | erk=A97818BD193A67A16FE83A855E1BE9FB5640938D4DBCB2CB52C5A2F8B02B1031 36 | riv=4ACEF01224FBEEDF8245F8FF10211E6E 37 | pub=41DA1A8F74FF8D3F1CE20EF3E9D8865C96014FE373CA143C9BADEDF2D9D3C7573307115CCFE04F13 38 | priv=00542D46E7B3DAAC8AEB81E533873AABD6D74BB710 39 | ctype=23 40 | 41 | [pkg] 42 | type=PKG 43 | revision=01 44 | version=0003005600000000 45 | erk=F8F99006F1C007D5D0B1909E9566E0E70B569399FC3394A811809FDB5CAE92CD 46 | riv=59D28DB4ADDFB40B7D768BC9667C67B1 47 | pub=5432BDDD1F97418147AFF016EAA6100834F2CAA8C498B88965689EE44DF349B066CD43CBF4F2C5D0 48 | priv= 49 | ctype=17 50 | 51 | [spp] 52 | type=SPP 53 | revision=00 54 | version=0003005500000000 55 | erk=56C655747A4B6957A2D8BB9AC605C297E6AC9871932BFECDDE066CEE5B29470A 56 | riv=007E6B268EF1E986D10A9889CF93A8CB 57 | pub=265C04E7F20C3B8ACAC90E7C9D12757ED7ACBC01AA6624A2A927E719A4AA1222F87D917005F6072A 58 | priv=0001608EF3BACAFFB8C3A5958A24F758325B62B08C 59 | ctype=22 60 | 61 | [spp] 62 | type=SPP 63 | revision=01 64 | version=0003005600000000 65 | erk=7FD222B3FEF467DF7E3F63AC8B77501A3B38752411E96AFEDA6587B5CD5E91B0 66 | riv=B889290922B002F57086B818A8FDE3CC 67 | pub=71E12CB3D81AFA79670AF4FAC4BBE41AA7F7DDF368F5615E933CB1C21A783B73C085CA49986CCF63 68 | priv= 69 | ctype=22 70 | 71 | [spp] 72 | type=SPP 73 | revision=02 74 | version=0003006000000000 75 | erk=ED17248214B9AB34D57ED5CA6CCAEC9879137B4B46CE5064E6491D34001BACF2 76 | riv=3E05572881C5BC845D310EAC28497B08 77 | pub=504F905A8AAAA0E9BF55F6D5285697E2CABDB1A5240C4745BE8923308169EAB43E1BFD265F5E579E 78 | priv= 79 | ctype= 80 | 81 | [rvk] 82 | type=RVK 83 | revision=00 84 | version=0003005500000000 85 | erk=03AF06FD1CE6DA366361682CDF59F9708B5D7876F40A9E1E9AC2B22F51B60BDF 86 | riv=8B5D7876F40A9E1E9AC2B22F51B60BDF 87 | pub=9ADE7830EB74245EC357CE4F6401633E5A8048FD865F9D8F1A9189535A37623E2921427463A754F7 88 | priv=00245E673B039D656DA206BDAE4EAEFCBF2A8D5EAF 89 | ctype=29 90 | 91 | [rvk] 92 | type=RVK 93 | revision=01 94 | version=0003005600000000 95 | erk=22628A9EC4C414D5B32F2B4BA4926089DE9A461B190FB3E4392D057C525535DE 96 | riv=D5D4B8ED62B6CCA0249A79776E136975 97 | pub=51751B9F1DA58638D2D99F67E20A1D4A454C5B042CD1D0A449A2989808002BA68FB5B7F4B5B4E63B 98 | priv= 99 | ctype=32 100 | 101 | [rvk] 102 | type=RVK 103 | revision=02 104 | version=0003006000000000 105 | erk=BCFEDBE01D445CDEF335C543703D8E9C1199FAC33DC4595D7382EAF54EF9C4C3 106 | riv=B20A23079516205525683D8058379CBF 107 | pub=9859B677A5B8FCCA31A6FBA2E3220EE5E207343A58EEEE6B6CB260EB5E971352C45428E8C8398BE6 108 | priv= 109 | ctype= 110 | 111 | [metldr] 112 | type=SELF 113 | revision=00 114 | self_type=LDR 115 | erk=C0CEFE84C227F75BD07A7EB846509F93B238E770DACB9FF4A388F812482BE21B 116 | riv=47EE7454E4774CC9B8960C7B59F4C14D 117 | pub=C2D4AAF319355019AF99D44E2B58CA29252C89123D11D6218F40B138CAB29B7101F3AEB72A975019 118 | priv=00C5B2BFA1A413DD16F26D31C0F2ED4720DCFB0670 119 | ctype=20 120 | 121 | [isoldr] 122 | type=SELF 123 | version=0003001500000000 124 | self_type=ISO 125 | erk=8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4 126 | riv=C82D015D46CF152F1DD0C16F18B5B1E5 127 | pub=733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29 128 | priv=009BE892E122A5C943C1BB7403A67318AA9E1B286F 129 | ctype=36 130 | 131 | [isoldr] 132 | type=SELF 133 | version=0003003100000000 134 | self_type=ISO 135 | erk=8860D0CFF4D0DC688D3223321B96B59A777E6914961488E07048DAECB020ECA4 136 | riv=C82D015D46CF152F1DD0C16F18B5B1E5 137 | pub=733918D7C888130509346E6B4A8B6CAA357AB557E814E8122BF102C14A314BF9475B9D70EAF9EC29 138 | priv=009BE892E122A5C943C1BB7403A67318AA9E1B286F 139 | ctype=36 140 | 141 | [isoldr] 142 | type=SELF 143 | version=0003004100000000 144 | self_type=ISO 145 | erk=101E27F3FA2FB53ACA924F783AD553162D56B975D05B81351A1111799F20254D 146 | riv=8D2E9C6297B8AD252998458296AC773C 147 | pub=138446EE0BDDA5638F97328C8956E6489CBBFE57C5961D40DD5C43BB4138F1C400A8B27204A5D625 148 | priv=00849DBC57D3B92F01864E6E82EB4EF0EF6311E122 149 | ctype=32 150 | 151 | [isoldr] 152 | type=SELF 153 | version=0003005000000000 154 | self_type=ISO 155 | erk=3F2604FA27AEADFBE1AC69EB00BB16EF196C2193CBD62900FFD8C25041680843 156 | riv=A414AC1DB7987E43777651B330B899E1 157 | pub=1F4633AFDE18614D6CEF38A2FD6C4CCAC7B6EB8109D72CD066ECEBA0193EA3F43C37AE83179A4E5F 158 | priv=0085B4B05DEBA7E6AD831653C974D95149803BB272 159 | ctype=33 160 | 161 | [isoldr] 162 | type=SELF 163 | version=0003005500000000 164 | self_type=ISO 165 | erk=BDB74AA6E3BA2DC10B1BD7F17198399A158DBE1FA0BEA68C90FCACBE4D04BE37 166 | riv=0207A479B1574F8E7F697528F05D5435 167 | pub=917E1F1DC48A54EB5F10B38E7569BB5383628A7C906F0DCA62FDA33805C15FAB270016940A09DB58 168 | priv=00294411363290975BA551336D3965D88AF029A17B 169 | ctype=03 170 | 171 | [isoldr] 172 | type=SELF 173 | version=0003005600000000 174 | self_type=ISO 175 | erk=311C015F169F2A1E0757F7064B14C7C9F3A3FFEE015BD4E3A22401A2667857CE 176 | riv=7BB8B3F5AC8E0890E3148AE5688C7350 177 | pub=3F040EFA2335FED5670BA4D5C3AB2D9D0B4BA69D154A0062EA995A7D21DBAF0DC5A0DAD333D1C1DD 178 | priv= 179 | ctype=08 180 | 181 | [isoldr] 182 | type=SELF 183 | version=0003006000000000 184 | self_type=ISO 185 | erk=8474ADCA3B3244931EECEB9357841442442A1C4A4BCF4E498E6738950F4E4093 186 | riv=FFF9CACCC4129125CAFB240F419E5F39 187 | pub=098E1A53E59A95316B00D5A29C05FFEBAE41D1A8A386F9DA96F98858FD25E07BB7A3BC96A5D5B556 188 | priv= 189 | ctype=03 190 | 191 | [isoldr] 192 | type=SELF 193 | revision=0001 194 | version=0004002000000000 195 | self_type=ISO 196 | erk=63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086 197 | riv=953F6A99891B4739358F5363A00C08B9 198 | pub=26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612 199 | priv= 200 | ctype=15 201 | 202 | [isoldr] 203 | type=SELF 204 | revision=0001 205 | version=0004003000000000 206 | self_type=ISO 207 | erk=63565DBE98C3B1A52AADC907C47130FE57A10734E84F22592670F86ED2B0A086 208 | riv=953F6A99891B4739358F5363A00C08B9 209 | pub=26BE7B02E7D65C6C21BF4063CDB8C0092FE1679D62FA1A8CCC284A1D21885473A959992537A06612 210 | priv= 211 | ctype=15 212 | 213 | [lv1ldr] 214 | type=SELF 215 | version=0003001500000000 216 | self_type=LV1 217 | erk=B9F3F9E6107CFF2680A91E118C2403CF4A6F18F3C7EFD7D13D1AC4DB760BD222 218 | riv=B43661B9A79BAD9D8E2B046469CDA1E7 219 | pub=4C870BE86DDD996A92A3F7F404F33604244A1D02AB5B78BC9DAF030B78BE8867CF586171B7D45D20 220 | priv=002CC736C7AD06D264E9AB663EB1F35F5DC159248C 221 | ctype=33 222 | 223 | [lv1ldr] 224 | type=SELF 225 | version=0003004100000000 226 | self_type=LV1 227 | erk=B880593856C8C6D2037585626A12977F50DCFCF3F132D2C89AA6E670EAFC1646 228 | riv=A79B05D4E37B8117A95E6E7C14FB640E 229 | pub=7454C7CCBFC2F66C142D78A730A3A6F973CC0FB75A46FCBB390790138910A0CAC78E5E21F4DA3375 230 | priv=00033A699FDD2DA6CDD6CCC03B2C6145F998706F74 231 | ctype=34 232 | 233 | [lv1ldr] 234 | type=SELF 235 | version=0003005000000000 236 | self_type=LV1 237 | erk=1E8EEEA9E80A729F3FA52CF523B25941EA44B4155D94E5DADC5C5A77847620C7 238 | riv=E034D31A80316960024D1B3D3164FDC3 239 | pub=7E3A196F4A5879F3A7B091A2263F7C24E1716129B580566D308D9C2254B36AEE53DEF30EC85F8398 240 | priv=005815D17125D04C33790321DE29EB6241365100B5 241 | ctype=35 242 | 243 | [lv1ldr] 244 | type=SELF 245 | version=0003005500000000 246 | self_type=LV1 247 | erk=53ABDF84BE08B0351B734F2B97D2BE1621BC6C889E4362E5C70F39D6C3ED9F23 248 | riv=44E652661AC7584DBE08ECB810FB5FC0 249 | pub=733198A7759BC07326755BC9773A8A17C8A7043C7BDAB83D88E230512E2EA3852D7DA4263A7E97F9 250 | priv=004312C65347ACBE95CC306442FEFD0AF4C2935EB3 251 | ctype=05 252 | 253 | [lv1ldr] 254 | type=SELF 255 | version=0003005600000000 256 | self_type=LV1 257 | erk=48793EBDDA1AF65D737DA2FDA2DD104447A698F8A82CAAEE992831711BA94E83 258 | riv=15DCF3C67147A45D09DE7521EECA07A1 259 | pub=85A8868C320127F10B6598964C69221C086702021D31803520E21FDE4DBE827766BE41825CB7328C 260 | priv= 261 | ctype=07 262 | 263 | [lv1ldr] 264 | type=SELF 265 | version=0003006000000000 266 | self_type=LV1 267 | erk=5FF17D836E2C4AD69476E2614F64BDD05B9115389A9A6D055B5B544B1C34E3D5 268 | riv=DF0F50EC3C4743C5B17839D7B49F24A4 269 | pub=1CDABE30833823F461CA534104115FFF60010B710631E435A7D915E82AE88EDE667264656CB7062E 270 | priv= 271 | ctype=05 272 | 273 | [lv1ldr] 274 | type=SELF 275 | revision=0000 276 | version=0004002000000000 277 | self_type=LV1 278 | erk=10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD 279 | riv=ED8699562C6AC65204FA166257E7FCF4 280 | pub=1C0587163886C7071808501900200000143FCF9E3B8586084080061518078D141C05C70D3885474918068C93143FCC17 281 | ctype=30 282 | 283 | [lv1ldr] 284 | type=SELF 285 | revision=0000 286 | version=0004003000000000 287 | self_type=LV1 288 | erk=10CEA04973FCCC12EC19924510822D8D4C41F657FD3D7E73F415A8D687421BCD 289 | riv=ED8699562C6AC65204FA166257E7FCF4 290 | pub=1C0587163886C7071808501900200000143FCF9E3B8586084080061518078D141C05C70D3885474918068C93143FCC17 291 | ctype=30 292 | 293 | [lv2ldr] 294 | type=SELF 295 | version=0000000800000000 296 | self_type=LV2 297 | erk=014485445EC9926C50F613AE77D9C37AA99838CCEB6F75FA78E29A8C622E8011 298 | riv=A17D6A522CB1B08F97DA8A82E97C12F7 299 | 300 | [lv2ldr] 301 | type=SELF 302 | version=0003001500000000 303 | self_type=LV2 304 | erk=94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F 305 | riv=9769BFD187B90990AE5FEA4E110B9CF5 306 | pub=AFAF5E96AF396CBB69071082C46A8F34A030E8EDB799E0A7BE00AA264DFF3AEBF7923920D559404D 307 | priv=0070ABF9361B02291829D479F56AB248203CD3EB46 308 | ctype=20 309 | 310 | [lv2ldr] 311 | type=SELF 312 | version=0003004100000000 313 | self_type=LV2 314 | erk=575B0A6C4B4F2760A03FE4189EBAF4D947279FD982B14070349098B08FF92C10 315 | riv=411CB18F460CE50CAF2C426D8F0D93C8 316 | pub=3FEE313954CB3039C321A7E33B97FFDEC8988A8B55759161B04DBF4731284E4A8191E3F17D32B0EA 317 | priv=0073076441A08CD179E5FACE349B86DA58B5B7BA78 318 | ctype=21 319 | 320 | [lv2ldr] 321 | type=SELF 322 | version=0003005000000000 323 | self_type=LV2 324 | erk=6DBD48D787C58803A8D724DA5ACF04FF8FCE91D7545D2322F2B7ABF57014AF68 325 | riv=603A36213708520ED5D745DEC1325BA5 326 | pub=5888CB83AC3CCA9610BC173C53141C0CA58B93719E744660CA8823D5EAEE8F9BF736997054E4B7E3 327 | priv=0009EBC3DE442FA5FBF6C4F3D4F9EAB07778A142BD 328 | ctype=22 329 | 330 | [lv2ldr] 331 | type=SELF 332 | version=0003005500000000 333 | self_type=LV2 334 | erk=84015E90FA23139628A3C75CC09714E6427B527A82D18ABC3E91CD8D7DDAFF17 335 | riv=5B240444D645F2038118F97FD5A145D5 336 | pub=B266318245266B2D33641CD8A864066D077FAC60B7E27399099A70A683454B70F9888E7CC0C2BF72 337 | priv=009D4CBA2BFB1A8330D3E20E59D281D476D231C73A 338 | ctype=32 339 | 340 | [lv2ldr] 341 | type=SELF 342 | version=0003005600000000 343 | self_type=LV2 344 | erk=EAE15444048EFDE7A831BFA9F5D96F047C9FCFF50723E292CF50F5417D81E359 345 | riv=9CA9282DC7FA9F315EF3156D970B7CD4 346 | pub=0D58938CB47598A6A672874F1768068F8B80D8D17014D2ABEBAC85E5B0993D9FB6F307DDC3DDA699 347 | priv= 348 | ctype=33 349 | 350 | [lv2ldr] 351 | type=SELF 352 | version=0003006000000000 353 | self_type=LV2 354 | erk=88AD367EDEC2FEED3E2F99B1C685075C41BDEC90C84F526CAF588F89BBD1CBCC 355 | riv=8D18E8E525230E63DE10291C9DD615BF 356 | pub=86EED1D65E58890ABDA9ACA486A2BDDB9C0A529C2053FAE301F0F698EAF443DA0F60595A597A7027 357 | priv= 358 | ctype=32 359 | 360 | [lv2ldr] 361 | type=SELF 362 | revision=0000 363 | version=0004002000000000 364 | self_type=LV2 365 | erk=0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03 366 | riv=9B79374722AD888EB6A35A2DF25A8B3E 367 | pub=695984B7EE2EC2F77FCC3120150DCE7E4480D84480DDD8C5940AEB6F79E63D17A8BA3E4E63B2BB06FC0CE57E3BB8FC46 368 | 369 | [lv2ldr] 370 | type=SELF 371 | revision=0000 372 | version=0004003000000000 373 | self_type=LV2 374 | erk=0CAF212B6FA53C0DA7E2C575ADF61DBE68F34A33433B1B891ABF5C4251406A03 375 | riv=9B79374722AD888EB6A35A2DF25A8B3E 376 | pub=695984B7EE2EC2F77FCC3120150DCE7E4480D84480DDD8C5940AEB6F79E63D17A8BA3E4E63B2BB06FC0CE57E3BB8FC46 377 | 378 | [appldr] 379 | type=SELF 380 | revision=0000 381 | version=0000008000000000 382 | self_type=APP 383 | erk=95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04 384 | riv=4A0955D946DB70D691A640BB7FAECC4C 385 | pub=6F8DF8EBD0A1D1DB08B30DD3A951E3F1F27E34030B42C729C55555232D61B834B8BDFFB07E54B343 386 | priv=006C3E4CCB2C69A5AD7C6F60448E50C7F9184EEAF4 387 | ctype=21 388 | 389 | [appldr] 390 | type=SELF 391 | revision=0001 392 | version=0003001500000000 393 | self_type=APP 394 | erk=79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB 395 | riv=6F0F25E1C8C4B7AE70DF968B04521DDA 396 | pub=94D1B7378BAFF5DFED269240A7A364ED68446741622E50BC6079B6E606A2F8E0A4C56E5CFF836526 397 | priv=003DE80167D2F0E9D30F2145144A558D1174F5410C 398 | ctype=11 399 | 400 | [appldr] 401 | type=SELF 402 | revision=0002 403 | version=0003001500000000 404 | self_type=APP 405 | erk=4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A 406 | riv=90C127A9B43BA9D8E89FE6529E25206F 407 | pub=8CA6905F46148D7D8D84D2AFCEAE61B41E6750FC22EA435DFA61FCE6F4F860EE4F54D9196CA5290E 408 | priv= 409 | ctype=13 410 | 411 | [appldr] 412 | type=SELF 413 | revision=0003 414 | version=0003001500000000 415 | self_type=APP 416 | erk=C1E6A351FCED6A0636BFCB6801A0942DB7C28BDFC5E0A053A3F52F52FCE9754E 417 | riv=E0908163F457576440466ACAA443AE7C 418 | pub=50022D5D37C97905F898E78E7AA14A0B5CAAD5CE8190AE5629A10D6F0CF4173597B37A95A7545C92 419 | priv= 420 | ctype=0B 421 | 422 | [appldr] 423 | type=SELF 424 | revision=0004 425 | version=0003004100000000 426 | self_type=APP 427 | erk=838F5860CF97CDAD75B399CA44F4C214CDF951AC795298D71DF3C3B7E93AAEDA 428 | riv=7FDBB2E924D182BB0D69844ADC4ECA5B 429 | pub=1F140E8EF887DAB52F079A06E6915A6460B75CD256834A43FA7AF90C23067AF412EDAFE2C1778D69 430 | priv=0074E922FDEE5DC4CDF22FC8D7986477F813400860 431 | ctype=14 432 | 433 | [appldr] 434 | type=SELF 435 | revision=0005 436 | version=0003004100000000 437 | self_type=APP 438 | erk=C109AB56593DE5BE8BA190578E7D8109346E86A11088B42C727E2B793FD64BDC 439 | riv=15D3F191295C94B09B71EBDE088A187A 440 | pub=B6BB0A84C649A90D97EBA55B555366F52381BB38A84C8BB71DA5A5A0949043C6DB249029A43156F7 441 | priv= 442 | ctype=15 443 | 444 | [appldr] 445 | type=SELF 446 | revision=0006 447 | version=0003004100000000 448 | self_type=APP 449 | erk=6DFD7AFB470D2B2C955AB22264B1FF3C67F180983B26C01615DE9F2ECCBE7F41 450 | riv=24BD1C19D2A8286B8ACE39E4A37801C2 451 | pub=71F46AC33FF89DF589A100A7FB64CEAC244C9A0CBBC1FDCE80FB4BF8A0D2E66293309CB8EE8CFA95 452 | priv= 453 | ctype=2C 454 | 455 | [appldr] 456 | type=SELF 457 | revision=0007 458 | version=0003005000000000 459 | self_type=APP 460 | erk=945B99C0E69CAF0558C588B95FF41B232660ECB017741F3218C12F9DFDEEDE55 461 | riv=1D5EFBE7C5D34AD60F9FBC46A5977FCE 462 | pub=AB284CA549B2DE9AA5C903B75652F78D192F8F4A8F3CD99209415C0A84C5C9FD6BF3095C1C18FFCD 463 | priv=002CF896D35DB871D0E6A252E799876A70D043C23E 464 | ctype=15 465 | 466 | [appldr] 467 | type=SELF 468 | revision=0008 469 | version=0003005000000000 470 | self_type=APP 471 | erk=2C9E8969EC44DFB6A8771DC7F7FDFBCCAF329EC3EC070900CABB23742A9A6E13 472 | riv=5A4CEFD5A9C3C093D0B9352376D19405 473 | pub=6E82F6B54A0E9DEBE4A8B3043EE3B24CD9BBB62B4416B0482582E419A2552E29AB4BEA0A4D7FA2D5 474 | priv= 475 | ctype=16 476 | 477 | [appldr] 478 | type=SELF 479 | revision=0009 480 | version=0003005000000000 481 | self_type=APP 482 | erk=F69E4A2934F114D89F386CE766388366CDD210F1D8913E3B973257F1201D632B 483 | riv=F4D535069301EE888CC2A852DB654461 484 | pub=1D7B974D10E61C2ED087A0981535904677EC07E96260F89565FF7EBDA4EE035C2AA9BCBDD5893F99 485 | priv= 486 | ctype=2D 487 | 488 | [appldr] 489 | type=SELF 490 | revision=000A 491 | version=0003005500000000 492 | self_type=APP 493 | erk=29805302E7C92F204009161CA93F776A072141A8C46A108E571C46D473A176A3 494 | riv=5D1FAB844107676ABCDFC25EAEBCB633 495 | pub=09301B6436C85B53CB1585300A3F1AF9FB14DB7C30088C4642AD66D5C148B8995BB1A698A8C71827 496 | priv=0010818ED8A666051C6198662C3D6DDE2CA4901DDC 497 | ctype=25 498 | 499 | [appldr] 500 | type=SELF 501 | revision=000B 502 | version=0003005500000000 503 | self_type=APP 504 | erk=A4C97402CC8A71BC7748661FE9CE7DF44DCE95D0D58938A59F47B9E9DBA7BFC3 505 | riv=E4792F2B9DB30CB8D1596077A13FB3B5 506 | pub=2733C889D289550FE00EAA5A47A34CEF0C1AF187610EB07BA35D2C09BB73C80B244EB4147700D1BF 507 | priv= 508 | ctype=26 509 | 510 | [appldr] 511 | type=SELF 512 | revision=000C 513 | version=0003005500000000 514 | self_type=APP 515 | erk=9814EFFF67B7074D1B263BF85BDC8576CE9DEC914123971B169472A1BC2387FA 516 | riv=D43B1FA8BE15714B3078C23908BB2BCA 517 | pub=7D1986C6BEE6CE1E0C5893BD2DF203881F40D5056761CC3F1F2E9D9A378617A2DE40BA5F09844CEB 518 | priv= 519 | ctype=3D 520 | 521 | [appldr] 522 | type=SELF 523 | revision=000D 524 | version=0003005600000000 525 | self_type=APP 526 | erk=03B4C421E0C0DE708C0F0B71C24E3EE04306AE7383D8C5621394CCB99FF7A194 527 | riv=5ADB9EAFE897B54CB1060D6885BE22CF 528 | pub=71502ADB5783583AB88B2D5F23F419AF01C8B1E72FCA1E694AD49FE3266F1F9C61EFC6F29B351142 529 | priv= 530 | ctype=12 531 | 532 | [appldr] 533 | type=SELF 534 | revision=000E 535 | version=0003005600000000 536 | self_type=APP 537 | erk=39A870173C226EB8A3EEE9CA6FB675E82039B2D0CCB22653BFCE4DB013BAEA03 538 | riv=90266C98CBAA06C1BF145FF760EA1B45 539 | pub=84DE5692809848E5ACBE25BE548F6981E3DB14735A5DDE1A0FD1F475866532B862B1AB6A004B7255 540 | priv= 541 | ctype=27 542 | 543 | [appldr] 544 | type=SELF 545 | revision=000F 546 | version=0003005600000000 547 | self_type=APP 548 | erk=FD52DFA7C6EEF5679628D12E267AA863B9365E6DB95470949CFD235B3FCA0F3B 549 | riv=64F50296CF8CF49CD7C643572887DA0B 550 | pub=0696D6CCBD7CF585EF5E00D547503C185D7421581BAD196E081723CD0A97FA40B2C0CD2492B0B5A1 551 | priv= 552 | ctype=3A 553 | 554 | [appldr] 555 | type=SELF 556 | revision=0010 557 | version=0003006000000000 558 | self_type=APP 559 | erk=A5E51AD8F32FFBDE808972ACEE46397F2D3FE6BC823C8218EF875EE3A9B0584F 560 | riv=7A203D5112F799979DF0E1B8B5B52AA4 561 | pub=50597B7F680DD89F6594D9BDC0CBEE03666AB53647D0487F7F452FE2DD02694631EA755548C9E934 562 | priv= 563 | ctype=25 564 | 565 | [appldr] 566 | type=SELF 567 | revision=0011 568 | version=0003006000000000 569 | self_type=APP 570 | erk=0F8EAB8884A51D092D7250597388E3B8B75444AC138B9D36E5C7C5B8C3DF18FD 571 | riv=97AF39C383E7EF1C98FA447C597EA8FE 572 | pub=2FDA7A56AAEA65921C0284FF1942C6DE137370093D106034B59191951A5201B422D462F8726F852D 573 | priv= 574 | ctype=26 575 | 576 | [appldr] 577 | type=SELF 578 | revision=0013 579 | version=0003006500000000 580 | self_type=APP 581 | erk=DBF62D76FC81C8AC92372A9D631DDC9219F152C59C4B20BFF8F96B64AB065E94 582 | riv=CB5DD4BE8CF115FFB25801BC6086E729 583 | pub=B26FE6D3E3A1E766FAE79A8E6A7F48998E7FC1E4B0AD8745FF54C018C2A6CC7A0DD7525FAFEA4917 584 | priv= 585 | ctype=12 586 | 587 | [appldr] 588 | type=SELF 589 | revision=0014 590 | version=0003006500000000 591 | self_type=APP 592 | erk=491B0D72BB21ED115950379F4564CE784A4BFAABB00E8CB71294B192B7B9F88E 593 | riv=F98843588FED8B0E62D7DDCB6F0CECF4 594 | pub=04275E8838EF95BD013B223C3DF674540932F21B534C7ED2944B9104D938FEB03B824DDB866AB26E 595 | priv= 596 | ctype=27 597 | 598 | [appldr] 599 | type=SELF 600 | revision=0016 601 | version=0003007000000000 602 | self_type=APP 603 | erk=A106692224F1E91E1C4EBAD4A25FBFF66B4B13E88D878E8CD072F23CD1C5BF7C 604 | riv=62773C70BD749269C0AFD1F12E73909E 605 | pub=566635D3E1DCEC47243AAD1628AE6B2CEB33463FC155E4635846CE33899C5E353DDFA47FEF5694AF 606 | priv= 607 | ctype=30 608 | 609 | [appldr] 610 | type=SELF 611 | revision=0017 612 | version=0003007000000000 613 | self_type=APP 614 | erk=4E104DCE09BA878C75DA98D0B1636F0E5F058328D81419E2A3D22AB0256FDF46 615 | riv=954A86C4629E116532304A740862EF85 616 | pub=3B7B04C71CAE2B1199D57453C038BB1B541A05AD1B94167B0AB47A9B24CAECB9000CB21407009666 617 | priv= 618 | ctype=08 619 | 620 | [appldr] 621 | type=SELF 622 | revision=0019 623 | version=0004000000000000 624 | self_type=APP 625 | erk=3236B9937174DF1DC12EC2DD8A318A0EA4D3ECDEA5DFB4AC1B8278447000C297 626 | riv=6153DEE781B8ADDC6A439498B816DC46 627 | pub=148DCA961E2738BAF84B2D1B6E2DA2ABD6A95F2C9571E54C6922F9ED9674F062B7F1BE5BD6FA5268 628 | priv= 629 | ctype=31 630 | 631 | [appldr] 632 | type=SELF 633 | revision=001A 634 | version=0004000000000000 635 | self_type=APP 636 | erk=5EFD1E9961462794E3B9EF2A4D0C1F46F642AAE053B5025504130590E66F19C9 637 | riv=1AC8FA3B3C90F8FDE639515F91B58327 638 | pub=BE4B1B513536960618BFEF12A713F6673881B02F9DC616191E823FC8337CCF99ADAA6172019C0C23 639 | priv= 640 | ctype=17 641 | 642 | [appldr] 643 | type=SELF 644 | revision=001C 645 | version=0004002000000000 646 | self_type=APP 647 | erk=CFF025375BA0079226BE01F4A31F346D79F62CFB643CA910E16CF60BD9092752 648 | riv=FD40664E2EBBA01BF359B0DCDF543DA4 649 | pub=36C1ACE6DD5CCC0006FDF3424750FAC515FC5CFA2C93EC53C6EC2BC421708D154E91F2E7EA54A893 650 | priv= 651 | ctype=09 652 | 653 | [appldr] 654 | type=SELF 655 | revision=001D 656 | version=0004002000000000 657 | self_type=APP 658 | erk=D202174EB65A62048F3674B59EF6FE72E1872962F3E1CD658DE8D7AF71DA1F3E 659 | riv=ACB9945914EBB7B9A31ECE320AE09F2D 660 | pub=430322887503CF52928FAAA410FD623C7321281C8825D95F5B47EF078EFCFC44454C3AB4F00BB879 661 | priv= 662 | ctype=1A 663 | 664 | [appldr] 665 | type=SELF 666 | revision=001E 667 | version=0004003000000000 668 | self_type=APP 669 | erk=46BD0891224E0CE13E2162921D4BB76193AEEE4416A729FCDD111C5536BF87C9 670 | riv=BF036387CDB613C0AC88A6D9D2CC5316 671 | pub=A14F6D5F9AD7EBB3B7A39A7C32F13E5DC3B0BA16BDC33D39FDDF88F4AEEA6CFEEB0C0796C917A952 672 | priv= 673 | ctype=0F 674 | 675 | 676 | 677 | [appldr] 678 | type=SELF 679 | revision=0000 680 | version=0000009200000000 681 | self_type=NPDRM 682 | erk=D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085 683 | riv=DC01280A6E46BC674B81A7E8801EBE6E 684 | pub=A0FC44108236141BF3517A662B027AFC1AC513A05690496C754DEB7D43BDC41B80FD75C212624EE4 685 | priv= 686 | ctype=11 687 | 688 | [appldr] 689 | type=SELF 690 | revision=0001 691 | version=0001000000000000 692 | self_type=NPDRM 693 | erk=F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B 694 | riv=A551CCB4A42C37A734A2B4F9657D5540 695 | pub=B05F9DA5F9121EE4031467E74C505C29A8E29D1022379EDFF0500B9AE480B5DAB4578A4C61C5D6BF 696 | priv=00040AB47509BED04BD96521AD1B365B86BF620A98 697 | ctype=11 698 | 699 | [appldr] 700 | type=SELF 701 | revision=0002 702 | version=0001000000000000 703 | self_type=NPDRM 704 | erk=8E737230C80E66AD0162EDDD32F1F774EE5E4E187449F19079437A508FCF9C86 705 | riv=7AAECC60AD12AED90C348D8C11D2BED5 706 | pub=05BF09CB6FD78050C78DE69CC316FF27C9F1ED66A45BFCE0A1E5A6749B19BD546BBB4602CF373440 707 | priv= 708 | ctype=0A 709 | 710 | [appldr] 711 | type=SELF 712 | revision=0003 713 | version=0003001500000000 714 | self_type=NPDRM 715 | erk=1B715B0C3E8DC4C1A5772EBA9C5D34F7CCFE5B82025D453F3167566497239664 716 | riv=E31E206FBB8AEA27FAB0D9A2FFB6B62F 717 | pub=3F51E59FC74D6618D34431FA67987FA11ABBFACC7111811473CD9988FE91C43FC74605E7B8CB732D 718 | priv= 719 | ctype=08 720 | 721 | [appldr] 722 | type=SELF 723 | revision=0004 724 | version=0003004000000000 725 | self_type=NPDRM 726 | erk=BB4DBF66B744A33934172D9F8379A7A5EA74CB0F559BB95D0E7AECE91702B706 727 | riv=ADF7B207A15AC601110E61DDFC210AF6 728 | pub=9C327471BAFF1F877AE4FE29F4501AF5AD6A2C459F8622697F583EFCA2CA30ABB5CD45D1131CAB30 729 | priv=00B61A91DF4AB6A9F142C326BA9592B5265DA88856 730 | ctype=16 731 | 732 | [appldr] 733 | type=SELF 734 | revision=0005 735 | version=0003004000000000 736 | self_type=NPDRM 737 | erk=B73111B0B00117E48DE5E2EE5E534C0F0EFFA4890BBB8CAD01EE0F848F91583E 738 | riv=86F56F9E5DE513894874B8BA253334B1 739 | pub=B0BA1A1AB9723BB4E87CED9637BE056066BC56E16572D43D0210A06411DBF8FEB8885CD912384AE5 740 | priv= 741 | ctype=12 742 | 743 | [appldr] 744 | type=SELF 745 | revision=0006 746 | version=0003004000000000 747 | self_type=NPDRM 748 | erk=8B4C52849765D2B5FA3D5628AFB17644D52B9FFEE235B4C0DB72A62867EAA020 749 | riv=05719DF1B1D0306C03910ADDCE4AF887 750 | pub=2A5D6C6908CA98FC4740D834C6400E6D6AD74CF0A712CF1E7DAE806E98605CC308F6A03658F2970E 751 | priv= 752 | ctype=29 753 | 754 | [appldr] 755 | type=SELF 756 | revision=0007 757 | version=0003005000000000 758 | self_type=NPDRM 759 | erk=3946DFAA141718C7BE339A0D6C26301C76B568AEBC5CD52652F2E2E0297437C3 760 | riv=E4897BE553AE025CDCBF2B15D1C9234E 761 | pub=A13AFE8B63F897DA2D3DC3987B39389DC10BAD99DFB703838C4A0BC4E8BB44659C726CFD0CE60D0E 762 | priv=009EF86907782A318D4CC3617EBACE2480E73A46F6 763 | ctype=17 764 | 765 | [appldr] 766 | type=SELF 767 | revision=0008 768 | version=0003005000000000 769 | self_type=NPDRM 770 | erk=8E944267C02E69A4FE474B7F5FCD7974A4F936FF4355AEC4F80EFA123858D8F6 771 | riv=908A75754E521EAC2F5A4889C6D7B72D 772 | pub=91201DA7D79E8EE2563142ECBD646DA026C963AC09E760E5390FFE24DAE6864310ABE147F8204D0B 773 | priv= 774 | ctype=13 775 | 776 | [appldr] 777 | type=SELF 778 | revision=0009 779 | version=0003005000000000 780 | self_type=NPDRM 781 | erk=0786F4B0CA5937F515BDCE188F569B2EF3109A4DA0780A7AA07BD89C3350810A 782 | riv=04AD3C2F122A3B35E804850CAD142C6D 783 | pub=A1FE61035DBBEA5A94D120D03C000D3B2F084B9F4AFA99A2D4A588DF92B8F36327CE9E47889A45D0 784 | priv= 785 | ctype=2A 786 | 787 | [appldr] 788 | type=SELF 789 | revision=000A 790 | version=0003005500000000 791 | self_type=NPDRM 792 | erk=03C21AD78FBB6A3D425E9AAB1298F9FD70E29FD4E6E3A3C151205DA50C413DE4 793 | riv=0A99D4D4F8301A88052D714AD2FB565E 794 | pub=3995C390C9F7FBBAB124A1C14E70F9741A5E6BDF17A605D88239652C8EA7D5FC9F24B30546C1E44B 795 | priv=009AC6B22A056BA9E0B6D1520F28A57A3135483F9F 796 | ctype=27 797 | 798 | [appldr] 799 | type=SELF 800 | revision=000B 801 | version=0003005500000000 802 | self_type=NPDRM 803 | erk=BB31DF9A6F62C0DF853075FAA65134D9CE2240306C1731D1F7DA9B5329BD699F 804 | riv=263057225873F83940A65C8C926AC3E4 805 | pub=BC3A82A4F44C43A197070CD236FDC94FCC542D69A3E803E0AFF78D1F3DA19A79D2F61FAB5B94B437 806 | priv= 807 | ctype=23 808 | 809 | [appldr] 810 | type=SELF 811 | revision=000C 812 | version=0003005500000000 813 | self_type=NPDRM 814 | erk=337A51416105B56E40D7CAF1B954CDAF4E7645F28379904F35F27E81CA7B6957 815 | riv=8405C88E042280DBD794EC7E22B74002 816 | pub=9BFF1CC7118D2393DE50D5CF44909860683411A532767BFDAC78622DB9E5456753FE422CBAFA1DA1 817 | priv= 818 | ctype=18 819 | 820 | [appldr] 821 | type=SELF 822 | revision=000D 823 | version=0003005600000000 824 | self_type=NPDRM 825 | erk=357EBBEA265FAEC271182D571C6CD2F62CFA04D325588F213DB6B2E0ED166D92 826 | riv=D26E6DD2B74CD78E866E742E5571B84F 827 | pub=00DCF5391618604AB42C8CFF3DC304DF45341EBA4551293E9E2B68FFE2DF527FFA3BE8329E015E57 828 | priv= 829 | ctype=3A 830 | 831 | [appldr] 832 | type=SELF 833 | revision=000E 834 | version=0003005600000000 835 | self_type=NPDRM 836 | erk=71AA75C70A255580E4AE9BDAA0B08828C53EAA713CD0713797F143B284C1589B 837 | riv=9DED878CB6BA07121C0F50E7B172A8BF 838 | pub=387FCDAEAFF1B59CFAF79CE6215A065ACEAFFAF4048A4F217E1FF5CE67C66EC3F089DB235E52F9D3 839 | priv= 840 | ctype=29 841 | 842 | [appldr] 843 | type=SELF 844 | revision=000F 845 | version=0003005600000000 846 | self_type=NPDRM 847 | erk=135C098CBE6A3E037EBE9F2BB9B30218DDE8D68217346F9AD33203352FBB3291 848 | riv=4070C898C2EAAD1634A288AA547A35A8 849 | pub=BBD7CCCB556C2EF0F908DC7810FAFC37F2E56B3DAA5F7FAF53A4944AA9B841F76AB091E16B231433 850 | priv= 851 | ctype=3B 852 | 853 | [appldr] 854 | type=SELF 855 | revision=0010 856 | version=0003006000000000 857 | self_type=NPDRM 858 | erk=4B3CD10F6A6AA7D99F9B3A660C35ADE08EF01C2C336B9E46D1BB5678B4261A61 859 | riv=C0F2AB86E6E0457552DB50D7219371C5 860 | pub=64A5C60BC2AD18B8A237E4AA690647E12BF7A081523FAD4F29BE89ACAC72F7AB43C74EC9AFFDA213 861 | ctype=27 862 | 863 | [appldr] 864 | type=SELF 865 | revision=0013 866 | version=0003006500000000 867 | self_type=NPDRM 868 | erk=265C93CF48562EC5D18773BEB7689B8AD10C5EB6D21421455DEBC4FB128CBF46 869 | riv=8DEA5FF959682A9B98B688CEA1EF4A1D 870 | pub=9D8DB5A880608DC69717991AFC3AD5C0215A5EE413328C2ABC8F35589E04432373DB2E2339EEF7C8 871 | priv= 872 | ctype=18 873 | 874 | [appldr] 875 | type=SELF 876 | revision=0016 877 | version=0003007000000000 878 | self_type=NPDRM 879 | erk=7910340483E419E55F0D33E4EA5410EEEC3AF47814667ECA2AA9D75602B14D4B 880 | riv=4AD981431B98DFD39B6388EDAD742A8E 881 | pub=62DFE488E410B1B6B2F559E4CB932BCB78845AB623CC59FDF65168400FD76FA82ED1DC60E091D1D1 882 | priv= 883 | ctype=25 884 | 885 | [appldr] 886 | type=SELF 887 | revision=0019 888 | version=0004000000000000 889 | self_type=NPDRM 890 | erk=FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3 891 | riv=F72C1D80FFDA2E3BF085F4133E6D2805 892 | pub=637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42 893 | priv= 894 | ctype=24 895 | 896 | [appldr] 897 | type=SELF 898 | revision=0019 899 | version=0004000100000000 900 | self_type=NPDRM 901 | erk=FBDA75963FE690CFF35B7AA7B408CF631744EDEF5F7931A04D58FD6A921FFDB3 902 | riv=F72C1D80FFDA2E3BF085F4133E6D2805 903 | pub=637EAD34E7B85C723C627E68ABDD0419914EBED4008311731DD87FDDA2DAF71F856A70E14DA17B42 904 | priv= 905 | ctype=24 906 | 907 | [appldr] 908 | type=SELF 909 | revision=001C 910 | version=0004002000000000 911 | self_type=NPDRM 912 | erk=8103EA9DB790578219C4CEDF0592B43064A7D98B601B6C7BC45108C4047AA80F 913 | riv=246F4B8328BE6A2D394EDE20479247C5 914 | pub=503172C9551308A87621ECEE90362D14889BFED2CF32B0B3E32A4F9FE527A41464B735E1ADBC6762 915 | priv= 916 | ctype=30 917 | -------------------------------------------------------------------------------- /data/ldr_curves: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/IngPereira/DynarecPS3/bd36250e2e0391cc90fccbc292f755f466e4d827/data/ldr_curves -------------------------------------------------------------------------------- /data/vsh_curves: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/IngPereira/DynarecPS3/bd36250e2e0391cc90fccbc292f755f466e4d827/data/vsh_curves -------------------------------------------------------------------------------- /htab_payload.h: -------------------------------------------------------------------------------- 1 | #pragma weak htab_payload 2 | #ifndef HTAB_PAYLOAD_H 3 | #define HTAB_PAYLOAD_H 4 | 5 | // Based on htab_payload.bin 0x700000 6 | uint64_t htab_payload[19]={ 7 | 0x7C0802A6F8010010ULL, 0xF821FF81F8410070ULL, 8 | 0x3C40800060420000ULL, 0x784207C664420070ULL, 9 | 0x60420098E8020000ULL, 0xE84200087C0903A6ULL, 10 | 0x4E800421E8410070ULL, 0x38210080E8010010ULL,// BCTR desc 11 | 0x7C0803A64E800020ULL, 0x78C607647C0802A6ULL,// 12 | 0xF801001060C60002ULL, 0xF821FF914800001DULL,// -> BL 13 | 0x6000000038210070ULL, 0x7C6307B4E8010010ULL, 14 | 0x7C0803A64E800020ULL, 0x7C0802A6F8010010ULL,// 15 | 0x3960000144000022ULL, 0x7C6307B4E8010010ULL, 16 | 0x7C0803A64E800020ULL}; 17 | 18 | #endif 19 | -------------------------------------------------------------------------------- /main.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | 12 | #include "patch421dex/patch421dex.h" 13 | #include "patch421/patch421.h" 14 | #include "core.h" 15 | 16 | //SYS_PROCESS_PARAM(1001, 0x10000); 17 | 18 | int main(void) 19 | { 20 | int firmware; 21 | char unitdbg[]={"/dev_hdd0"}; 22 | 23 | WriteLogInit(0,unitdbg,"APP: Running main base!\n");; 24 | 25 | // Here check fw's, so need to add other ones, right now just 4.21 DEX 26 | if(is_firm_421dex()) { 27 | firmware = 421646578; // 421dex 28 | } else if(is_firm_421()) { 29 | firmware = 421; // 421 CEX 30 | } 31 | 32 | switch(firmware) { 33 | 34 | case 421646578: //4.21 dex 35 | patch_421dex(); 36 | break; 37 | case 421: 38 | patch_421(); 39 | break; 40 | default: 41 | break; 42 | } 43 | 44 | WriteLogInit(1,NULL,"APP: Finished, OK\n");; 45 | 46 | return 0; 47 | 48 | } 49 | -------------------------------------------------------------------------------- /make-pkg.bat: -------------------------------------------------------------------------------- 1 | tools\psn_package_npdrm.exe tools\APP.conf PKG\DYNA00001 2 | pause -------------------------------------------------------------------------------- /make.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | set CONTENTID=LD0000-DYNA00001_00-0000000000000000 3 | make.exe 4 | del EBOOT.self 5 | RD objs /S /Q 6 | RD PKG/DYNA00001/USRDIR /S /Q 7 | tools\scetool.exe --self-app-version=0001000000000000 --sce-type=SELF --compress-data=TRUE --self-add-shdrs=TRUE --skip-sections=FALSE --key-revision=1 --self-auth-id=1010000001000003 --self-vendor-id=01000002 --self-type=NPDRM --np-license-type=FREE --np-app-type=EXEC --np-real-fname=EBOOT.BIN --self-fw-version=0003004000000000 --self-ctrl-flags 4000000000000000000000000000000000000000000000000000000000000002 --self-cap-flags 00000000000000000000000000000000000000000000007B0000000100000000 --np-content-id=%CONTENTID% --encrypt EBOOT.ELF EBOOT.BIN 8 | mkdir PKG\DYNA00001\USRDIR 9 | mv EBOOT.BIN PKG/DYNA00001/USRDIR/EBOOT.BIN 10 | pause 11 | -------------------------------------------------------------------------------- /makefile: -------------------------------------------------------------------------------- 1 | # SCE CONFIDENTIAL 2 | # PlayStation(R)3 Programmer Tool Runtime Library 370.001 3 | # Copyright (C) 2007 Sony Computer Entertainment Inc. 4 | # All Rights Reserved. 5 | 6 | CELL_SDK ?= /usr/local/cell 7 | CELL_MK_DIR ?= $(CELL_SDK)/samples/mk 8 | include $(CELL_MK_DIR)/sdk.makedef.mk 9 | 10 | PPU_SRCS = main.c core.c patch421dex/patch421dex.c patch421dex/hvcall421dex.c patch421/patch421.c patch421/hvcall421.c 11 | PPU_TARGET = EBOOT.ELF 12 | 13 | PPU_INCDIRS += -I$(CELL_TARGET_PATH)/include/ 14 | PPU_CFLAGS += -g -Wpadded -Wall -Wformat=0 15 | PPU_LDLIBS += -lio_stub -lm -lfs_stub -lsysutil_stub -lsysmodule_stub 16 | 17 | include $(CELL_MK_DIR)/sdk.target.mk 18 | -------------------------------------------------------------------------------- /patch421/fw_table421.h: -------------------------------------------------------------------------------- 1 | // DEFINES FOR 4.21 CFW 2 | #define SYSCALL_BASE 0x800000000035BCA8ULL 3 | #define FS_SYSCALL_RMDIR 813 // Just used to check FW ver 4 | #define RMDIR_SYSCALL_ADDR 0x80000000001B65C8ULL // where above syscall is in lv2 5 | 6 | #define patch_htab1 0x5CCA4ULL 7 | #define patch_htab2 0x5D6DCULL 8 | #define patch_htab3 0x5DBA4ULL 9 | #define HV_HASH_OFFSET 0x370A28 10 | 11 | // CEX address. 12 | #define HTAB_BASE 0x800000000f000000ULL 13 | #define HTAB_LV2_START 0x01000000ULL // LV2 START OFFSET on RAM 14 | #define HTAB_LV2_END 0x01800000ULL // LV2 END 15 | -------------------------------------------------------------------------------- /patch421/hvcall421.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | #include "hvcall421.h" 6 | #include "../core.h" 7 | 8 | #define HVSC_SYSCALL 811 // which syscall to overwrite with hvsc redirect 9 | #define HVSC_SYSCALL_ADDR 0x80000000001B60A0ULL // 4.21 -- replaces sys_fs_mkdir, later we remove it. 10 | #define SC_QUOTE_(x) #x 11 | #define SYSCALL(num) "li %%r11, " SC_QUOTE_(num) "; sc;" 12 | 13 | void hvsc_redirect421(uint8_t hvcall, uint8_t opt) 14 | { 15 | int x; 16 | 17 | uint64_t original_syscall_code_1 = lv2peek(HVSC_SYSCALL_ADDR); 18 | uint64_t original_syscall_code_2 = lv2peek(HVSC_SYSCALL_ADDR + 8); 19 | uint64_t original_syscall_code_3 = lv2peek(HVSC_SYSCALL_ADDR + 16); 20 | uint64_t original_syscall_code_4 = lv2peek(HVSC_SYSCALL_ADDR + 24); 21 | 22 | // Install redirect 23 | if(opt == 0) 24 | { 25 | for (x=0;x<25;x++) 26 | { 27 | lv2poke(HVSC_SYSCALL_ADDR, 0x7C0802A6F8010010ULL); 28 | lv2poke(HVSC_SYSCALL_ADDR + 8, 0x3960000044000022ULL | (uint64_t)hvcall << 32); 29 | lv2poke(HVSC_SYSCALL_ADDR + 16, 0xE80100107C0803A6ULL); 30 | lv2poke(HVSC_SYSCALL_ADDR + 24, 0x4e80002060000000ULL); 31 | __asm__("sync"); 32 | } 33 | } 34 | if(opt == 1) // Remove redirections 35 | { 36 | for (x=0;x<25;x++) 37 | { 38 | lv2poke(HVSC_SYSCALL_ADDR, original_syscall_code_1); 39 | lv2poke(HVSC_SYSCALL_ADDR + 8, original_syscall_code_2); 40 | lv2poke(HVSC_SYSCALL_ADDR + 16, original_syscall_code_3); 41 | lv2poke(HVSC_SYSCALL_ADDR + 24, original_syscall_code_4); 42 | __asm__("sync"); 43 | } 44 | } 45 | 46 | } 47 | 48 | int lv1_write_htab_entry421(uint64_t vas_id, uint64_t slot, uint64_t va, uint64_t pa) 49 | { 50 | hvsc_redirect421(1,1); // redirect to hvcall 1 51 | 52 | // call lv1_write_htab_entry 53 | uint64_t ret = 0; 54 | 55 | __asm__ __volatile__("mr %%r3, %1;" "mr %%r4, %2;" "mr %%r5, %3;" 56 | "mr %%r6, %4;" 57 | SYSCALL(HVSC_SYSCALL) "mr %0, %%r3;":"=r"(ret) 58 | :"r"(vas_id), "r"(slot), "r"(va), 59 | "r"(pa) 60 | :"r0", "r2", "r3", "r4", "r5", "r6", "r7", "r8", 61 | "r9", "r10", "r11", "r12", "lr", "ctr", "xer", 62 | "cr0", "cr1", "cr5", "cr6", "cr7", "memory"); 63 | 64 | hvsc_redirect421(1, 0); // Now remove hvsc redirections 65 | 66 | // Just one return r3 67 | return (int)ret; 68 | } 69 | -------------------------------------------------------------------------------- /patch421/hvcall421.h: -------------------------------------------------------------------------------- 1 | 2 | void hvsc_redirect421(uint8_t hvcall, uint8_t opt); 3 | int lv1_write_htab_entry421(uint64_t vas_id, uint64_t slot, uint64_t va, uint64_t pa); 4 | -------------------------------------------------------------------------------- /patch421/patch421.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | #include "patch421.h" 10 | #include "../core.h" 11 | #include "hvcall421.h" 12 | #include "fw_table421.h" 13 | #include "../htab_payload.h" 14 | 15 | int is_firm_421(void) 16 | { 17 | uint64_t addr = lv2peek((SYSCALL_BASE + FS_SYSCALL_RMDIR * 8)); 18 | // check address first 19 | if(addr < 0x8000000000000000ULL || addr > 0x80000000007FFFFFULL || (addr & 3)!=0) 20 | return 0; 21 | addr = lv2peek(addr); 22 | 23 | if(addr == RMDIR_SYSCALL_ADDR) return 1; 24 | 25 | return 0; 26 | } 27 | 28 | void patch_htab421() 29 | { 30 | int i,x; 31 | 32 | WriteLogInit(0,NULL,"APP: Installing new htab patch...");; 33 | 34 | //HTAB _CUSTOM call function, we patch it 25 times because there can be a fail patching in some times 35 | for (x=0;x<25;x++) 36 | { 37 | for (i=0; i< 19;i++) 38 | { 39 | lv2poke(0x8000000000700000ULL + (i * 0x8), htab_payload[i]); 40 | } 41 | __asm__("sync"); 42 | 43 | // Htab patch desc 44 | _poke(0x700098ULL, 0x8000000000700048ULL); // htab _Custom call desc 45 | 46 | } 47 | 48 | // Patching it 25 times because fail patching problem 49 | for (x=0;x<25;x++) 50 | { 51 | // @jump hooks: Replace hvsc calls by these jumps to the new functions 0x6FFFE0 52 | _poke32(patch_htab1, (0x48000001 | (uint32_t)(0x700000 - patch_htab1))); // BL to 0x700000 _CUSTOM CALL TO HTAB 53 | _poke32(patch_htab2, (0x48000001 | (uint32_t)(0x700000 - patch_htab2))); // BL to 0x700000 _CUSTOM CALL TO HTAB 54 | _poke32(patch_htab3, (0x48000001 | (uint32_t)(0x700000 - patch_htab3))); // BL to 0x700000 _CUSTOM CALL TO HTAB 55 | 56 | } 57 | 58 | WriteLogInit(0,NULL,"done\n");; 59 | 60 | 61 | } 62 | 63 | int patch_htabfix421() 64 | { 65 | int i, res; 66 | uint64_t pte0, pte1; 67 | 68 | // process entire lv2 69 | for (i = 0; i < 128; i++) 70 | { 71 | // read the old value 72 | pte0 = lv2peek(HTAB_BASE | (i << 7)); 73 | pte1 = lv2peek(HTAB_BASE | (i << 7) + 8); 74 | 75 | //verify entry is lv2 76 | if ((pte1 >= HTAB_LV2_START) && (pte1 < HTAB_LV2_END)) 77 | { 78 | // patch proper htab settings 79 | res = lv1_write_htab_entry421( 0, i << 3, pte0, (pte1 & 0xff0000) | 0x190 ); 80 | } 81 | } 82 | 83 | WriteLogInit(0,NULL,"APP: LV2 HTAB r|w|x parcheado OK!\n");; 84 | 85 | return res; 86 | 87 | } 88 | 89 | void patch_421() 90 | { 91 | int ret; 92 | 93 | WriteLogInit(0,NULL,"APP: Patching Lv2 hash on lv1...");; 94 | // Patch LV2 LV1 HASH 95 | lv1Poke(HV_HASH_OFFSET, 1); 96 | lv1Poke(HV_HASH_OFFSET + 8, 0xE0D251B556C59F05ULL); 97 | lv1Poke(HV_HASH_OFFSET + 16, 0xC232FCAD552C80D7ULL); 98 | lv1Poke(HV_HASH_OFFSET + 24, 0x65140CD200000000ULL); 99 | WriteLogInit(0,NULL,"done\n");; 100 | 101 | WriteLogInit(0,NULL,"APP: Patching lv2 htab r|w|x access...\n");; 102 | ret = patch_htabfix421(); // Patch htab rights access 103 | WriteLogInit(0,NULL,"APP: done with %d ret\n", ret);; 104 | 105 | sys_timer_usleep(10000); 106 | 107 | patch_htab421(); 108 | 109 | lv2_sm_ring_buzzer(0x1004, 0xa, 0x1b6); // BEEP 110 | 111 | 112 | } 113 | -------------------------------------------------------------------------------- /patch421/patch421.h: -------------------------------------------------------------------------------- 1 | 2 | int is_firm_421(void); 3 | void patch_htab421(void); 4 | int patch_htabfix421(void); 5 | void patch_421(void); 6 | -------------------------------------------------------------------------------- /patch421dex/fw_table421dex.h: -------------------------------------------------------------------------------- 1 | // DEFINES FOR 4.21 CFW DEX 2 | #define SYSCALL_BASE 0x800000000037A1B0ULL 3 | #define FS_SYSCALL_RMDIR 813 // Just used to check FW ver 4 | #define RMDIR_SYSCALL_ADDR 0x80000000001BC9B8ULL // where above syscall is in lv2 5 | 6 | #define patch_htab1 0x605BCULL 7 | #define patch_htab2 0x60FF4ULL 8 | #define patch_htab3 0x614BCULL 9 | #define HV_HASH_OFFSET 0x370A28 10 | 11 | // DEX LV2 START (TESTED ALREADY ON 421 DEX) 12 | #define HTAB_BASE 0x800000000f000000ULL 13 | #define HTAB_LV2_START 0x08000000ULL // LV2 START OFFSET ON RAM on DEX MACHINE 14 | #define HTAB_LV2_END 0x08800000ULL // LV2 END (Being 0x800000 the size) 15 | -------------------------------------------------------------------------------- /patch421dex/hvcall421dex.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | #include "hvcall421dex.h" 6 | #include "../core.h" 7 | 8 | #define HVSC_SYSCALL 811 // which syscall to overwrite with hvsc redirect 9 | #define HVSC_SYSCALL_ADDR 0x80000000001BC490ULL // 4.21 dex -- replaces sys_fs_mkdir, later we remove it. 10 | #define SC_QUOTE_(x) #x 11 | #define SYSCALL(num) "li %%r11, " SC_QUOTE_(num) "; sc;" 12 | 13 | void hvsc_redirect421dex(uint8_t hvcall, uint8_t opt) 14 | { 15 | int x; 16 | 17 | uint64_t original_syscall_code_1 = lv2peek(HVSC_SYSCALL_ADDR); 18 | uint64_t original_syscall_code_2 = lv2peek(HVSC_SYSCALL_ADDR + 8); 19 | uint64_t original_syscall_code_3 = lv2peek(HVSC_SYSCALL_ADDR + 16); 20 | uint64_t original_syscall_code_4 = lv2peek(HVSC_SYSCALL_ADDR + 24); 21 | 22 | // Install redirect 23 | if(opt == 0) 24 | { 25 | for (x=0;x<25;x++) 26 | { 27 | lv2poke(HVSC_SYSCALL_ADDR, 0x7C0802A6F8010010ULL); 28 | lv2poke(HVSC_SYSCALL_ADDR + 8, 0x3960000044000022ULL | (uint64_t)hvcall << 32); 29 | lv2poke(HVSC_SYSCALL_ADDR + 16, 0xE80100107C0803A6ULL); 30 | lv2poke(HVSC_SYSCALL_ADDR + 24, 0x4e80002060000000ULL); 31 | __asm__("sync"); 32 | } 33 | } 34 | if(opt == 1) // Remove redirections 35 | { 36 | for (x=0;x<25;x++) 37 | { 38 | lv2poke(HVSC_SYSCALL_ADDR, original_syscall_code_1); 39 | lv2poke(HVSC_SYSCALL_ADDR + 8, original_syscall_code_2); 40 | lv2poke(HVSC_SYSCALL_ADDR + 16, original_syscall_code_3); 41 | lv2poke(HVSC_SYSCALL_ADDR + 24, original_syscall_code_4); 42 | __asm__("sync"); 43 | } 44 | } 45 | 46 | } 47 | 48 | int lv1_write_htab_entry421dex(uint64_t vas_id, uint64_t slot, uint64_t va, uint64_t pa) 49 | { 50 | hvsc_redirect421dex(1,1); // redirect to hvcall 1 51 | 52 | // call lv1_write_htab_entry 53 | uint64_t ret = 0; 54 | 55 | __asm__ __volatile__("mr %%r3, %1;" "mr %%r4, %2;" "mr %%r5, %3;" 56 | "mr %%r6, %4;" 57 | SYSCALL(HVSC_SYSCALL) "mr %0, %%r3;":"=r"(ret) 58 | :"r"(vas_id), "r"(slot), "r"(va), 59 | "r"(pa) 60 | :"r0", "r2", "r3", "r4", "r5", "r6", "r7", "r8", 61 | "r9", "r10", "r11", "r12", "lr", "ctr", "xer", 62 | "cr0", "cr1", "cr5", "cr6", "cr7", "memory"); 63 | 64 | hvsc_redirect421dex(1, 0); // Now remove hvsc redirections 65 | 66 | // Just one return r3 67 | return (int)ret; 68 | } 69 | -------------------------------------------------------------------------------- /patch421dex/hvcall421dex.h: -------------------------------------------------------------------------------- 1 | 2 | void hvsc_redirect421dex(uint8_t hvcall, uint8_t opt); 3 | int lv1_write_htab_entry421dex(uint64_t vas_id, uint64_t slot, uint64_t va, uint64_t pa); 4 | -------------------------------------------------------------------------------- /patch421dex/patch421dex.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | #include "patch421dex.h" 10 | #include "../core.h" 11 | #include "hvcall421dex.h" 12 | #include "fw_table421dex.h" 13 | #include "../htab_payload.h" 14 | 15 | int is_firm_421dex(void) 16 | { 17 | uint64_t addr = lv2peek((SYSCALL_BASE + FS_SYSCALL_RMDIR * 8)); 18 | // check address first 19 | if(addr < 0x8000000000000000ULL || addr > 0x80000000007FFFFFULL || (addr & 3)!=0) 20 | return 0; 21 | addr = lv2peek(addr); 22 | 23 | if(addr == RMDIR_SYSCALL_ADDR) return 1; 24 | 25 | return 0; 26 | } 27 | 28 | void patch_htab421dex() 29 | { 30 | int i,x; 31 | 32 | WriteLogInit(0,NULL,"APP: Installing new htab patch...");; 33 | 34 | //HTAB _CUSTOM call function, we patch it 25 times because there can be a fail patching in some times 35 | for (x=0;x<25;x++) 36 | { 37 | for (i=0; i< 19;i++) 38 | { 39 | lv2poke(0x8000000000700000ULL + (i * 0x8), htab_payload[i]); 40 | } 41 | __asm__("sync"); 42 | 43 | // Htab patch desc 44 | _poke(0x700098ULL, 0x8000000000700048ULL); // htab _Custom call desc 45 | 46 | } 47 | 48 | // Patching it 25 times because fail patching problem 49 | for (x=0;x<25;x++) 50 | { 51 | // @jump hooks: Replace hvsc calls by these jumps to the new functions 0x6FFFE0 52 | _poke32(patch_htab1, (0x48000001 | (uint32_t)(0x700000 - patch_htab1))); // BL to 0x700000 _CUSTOM CALL TO HTAB 53 | _poke32(patch_htab2, (0x48000001 | (uint32_t)(0x700000 - patch_htab2))); // BL to 0x700000 _CUSTOM CALL TO HTAB 54 | _poke32(patch_htab3, (0x48000001 | (uint32_t)(0x700000 - patch_htab3))); // BL to 0x700000 _CUSTOM CALL TO HTAB 55 | 56 | } 57 | 58 | WriteLogInit(0,NULL,"done\n");; 59 | 60 | 61 | } 62 | 63 | int patch_htabfix421dex() 64 | { 65 | int i, res; 66 | uint64_t pte0, pte1; 67 | 68 | // process entire lv2 69 | for (i = 0; i < 128; i++) 70 | { 71 | // read the old value 72 | pte0 = lv2peek(HTAB_BASE | (i << 7)); 73 | pte1 = lv2peek(HTAB_BASE | (i << 7) + 8); 74 | 75 | //verify entry is lv2 76 | if ((pte1 >= HTAB_LV2_START) && (pte1 < HTAB_LV2_END)) 77 | { 78 | // patch proper htab settings 79 | res = lv1_write_htab_entry421dex( 0, i << 3, pte0, (pte1 & 0xff0000) | 0x190 ); 80 | } 81 | } 82 | 83 | WriteLogInit(0,NULL,"APP: LV2 HTAB r|w|x parcheado OK!\n");; 84 | 85 | return res; 86 | 87 | } 88 | 89 | void patch_421dex() 90 | { 91 | int ret; 92 | 93 | WriteLogInit(0,NULL,"APP: Patching Lv2 hash on lv1...");; 94 | // Patch LV2 LV1 HASH 95 | lv1Poke(HV_HASH_OFFSET, 1); 96 | lv1Poke(HV_HASH_OFFSET + 8, 0xE0D251B556C59F05ULL); 97 | lv1Poke(HV_HASH_OFFSET + 16, 0xC232FCAD552C80D7ULL); 98 | lv1Poke(HV_HASH_OFFSET + 24, 0x65140CD200000000ULL); 99 | WriteLogInit(0,NULL,"done\n");; 100 | 101 | WriteLogInit(0,NULL,"APP: Patching lv2 htab r|w|x access...\n");; 102 | ret = patch_htabfix421dex(); // Patch htab rights access 103 | WriteLogInit(0,NULL,"APP: done with %d ret\n", ret);; 104 | 105 | sys_timer_usleep(10000); 106 | 107 | patch_htab421dex(); 108 | 109 | lv2_sm_ring_buzzer(0x1004, 0xa, 0x1b6); // BEEP 110 | 111 | 112 | } 113 | -------------------------------------------------------------------------------- /patch421dex/patch421dex.h: -------------------------------------------------------------------------------- 1 | 2 | int is_firm_421dex(void); 3 | void patch_htab421dex(void); 4 | int patch_htabfix421dex(void); 5 | void patch_421dex(void); 6 | -------------------------------------------------------------------------------- /stuff/FullRamdumper/Makefile: -------------------------------------------------------------------------------- 1 | # SCE CONFIDENTIAL 2 | # PlayStation(R)3 Programmer Tool Runtime Library 370.001 3 | # Copyright (C) 2007 Sony Computer Entertainment Inc. 4 | # All Rights Reserved. 5 | 6 | CELL_SDK ?= /usr/local/cell 7 | CELL_MK_DIR ?= $(CELL_SDK)/samples/mk 8 | include $(CELL_MK_DIR)/sdk.makedef.mk 9 | 10 | PPU_SRCS = main.c core.c 11 | PPU_TARGET = EBOOT.ELF 12 | 13 | PPU_INCDIRS += -I$(CELL_TARGET_PATH)/include/ 14 | PPU_CFLAGS += -g -Wpadded -Wall -Wformat=0 15 | PPU_LDLIBS += -lio_stub -lm -lfs_stub -lsysutil_stub -lsysmodule_stub 16 | 17 | include $(CELL_MK_DIR)/sdk.target.mk 18 | -------------------------------------------------------------------------------- /stuff/FullRamdumper/core.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #include "core.h" 8 | 9 | int log = -1; 10 | 11 | int RebootShutdownMachine(int command) 12 | { 13 | system_call_3(379, command, 0, 0); 14 | return_to_user_prog(uint64_t); 15 | } 16 | 17 | int lv2FsChMode(char* path, int mode) 18 | { 19 | system_call_2(FILE_SYSTEM_CHMOD, (uint64_t)path, (uint64_t)mode); 20 | return_to_user_prog(uint64_t); 21 | } 22 | 23 | int lv2FsOpen(const char* path, uint64_t flags, int* fd, uint64_t special, const void* arg, uint64_t size) 24 | { 25 | system_call_6(FILE_SYSTEM_OPEN, (uint64_t)path, flags, (uint64_t)fd, special, (uint64_t)arg, size); 26 | return_to_user_prog(uint64_t); 27 | } 28 | 29 | int lv2FsRead(int fd, char* buffer, uint64_t size, uint64_t* bytes) 30 | { 31 | uint64_t temp_bytes; 32 | 33 | system_call_4(FILE_SYSTEM_READ, (uint64_t)fd, (uint64_t)buffer, size, !bytes ? (uint64_t)&temp_bytes : (uint64_t)bytes); 34 | return_to_user_prog(uint64_t); 35 | } 36 | 37 | int lv2FsWrite(int fd, void* buffer, uint64_t size, uint64_t* bytes) 38 | { 39 | uint64_t temp_bytes; 40 | 41 | system_call_4(FILE_SYSTEM_WRITE, (uint64_t)fd, (uint64_t)buffer, size, !bytes ? (uint64_t)&temp_bytes : (uint64_t)bytes); 42 | return_to_user_prog(uint64_t); 43 | } 44 | 45 | int lv2FsClose(int fd) 46 | { 47 | system_call_1(FILE_SYSTEM_CLOSE, (uint64_t)fd); 48 | return_to_user_prog(uint64_t); 49 | } 50 | 51 | int lv2FsOpenDir(const char* path, int* fd) 52 | { 53 | int result = ERROR_KERNEL_INVALID_MEMORY; 54 | if(path && fd) 55 | { 56 | system_call_2(FILE_SYSTEM_OPENDIR, (uint64_t)path, (uint64_t)fd); 57 | return_to_user_prog(uint64_t); 58 | } 59 | 60 | return result; 61 | } 62 | 63 | int lv2FsCloseDir(int fd) 64 | { 65 | system_call_1(FILE_SYSTEM_CLOSEDIR, (uint64_t)fd); 66 | return_to_user_prog(uint64_t); 67 | } 68 | 69 | int lv2FsUnLink(const char* path) 70 | { 71 | system_call_1(FILE_SYSTEM_UNLINK, (uint64_t)path); 72 | return_to_user_prog(uint64_t); 73 | } 74 | 75 | int lv2FsLseek(int fd, int64_t offset, int whence, uint64_t *pos) 76 | { 77 | if(pos) 78 | { 79 | system_call_4(FILE_SYSTEM_LSEEK, (uint64_t)fd, (uint64_t)offset, (uint64_t)whence, (uint64_t)pos); 80 | return_to_user_prog(uint64_t); 81 | } 82 | 83 | return ERROR_KERNEL_INVALID_MEMORY; 84 | } 85 | 86 | int lv2FsFSync(int fd) 87 | { 88 | system_call_1(FILE_SYSTEM_FSYNC, (uint64_t)fd); 89 | return_to_user_prog(uint64_t); 90 | } 91 | 92 | void WriteLogInit(uint32_t close, const char* unit, const char *fmt, ...) 93 | { 94 | int err; 95 | va_list list; 96 | char msg[256]; 97 | 98 | if(log == -1 && unit) 99 | { 100 | sprintf(msg, "%s/APP.log", unit); 101 | lv2FsUnLink(msg); 102 | err = lv2FsOpen(msg,CELL_FS_O_RDWR | CELL_FS_O_CREAT | CELL_FS_O_APPEND, &log, CELL_FS_DEFAULT_CREATE_MODE_6, 0, 0); 103 | lv2FsChMode(msg, S_IFMT | 0777); 104 | if(err != CELL_OK) 105 | { 106 | log = -1; 107 | return; 108 | } 109 | } 110 | 111 | va_start(list, fmt); 112 | vsprintf(msg, fmt, list); 113 | va_end(list); 114 | 115 | if(log != -1) 116 | { 117 | lv2FsWrite(log, msg, strlen(msg), NULL); 118 | lv2FsFSync(log); 119 | if(close) 120 | { 121 | lv2FsClose(log); 122 | log = -1; 123 | } 124 | } 125 | } 126 | 127 | int lv2_sm_ring_buzzer(uint64_t unknown1, uint8_t unknown2, uint32_t unknown3) 128 | { 129 | system_call_3(392, unknown1, unknown2, unknown3); 130 | return_to_user_prog(uint64_t); 131 | } 132 | 133 | uint64_t lv1Peek(uint64_t addr) 134 | { 135 | system_call_1(PEEKLV1, addr); 136 | return_to_user_prog(uint64_t); 137 | } 138 | 139 | void lv1Poke(uint64_t addr, uint64_t opcode) 140 | { 141 | system_call_2(POKELV1, addr, opcode); 142 | } 143 | 144 | uint64_t lv2peek(uint64_t addr) 145 | { 146 | system_call_1(6, addr); 147 | return_to_user_prog(uint64_t); 148 | } 149 | 150 | void lv2poke(uint64_t addr, uint64_t val) 151 | { 152 | system_call_2(7, addr, val); 153 | } 154 | 155 | void pokeq32(uint64_t addr, uint32_t val) 156 | { 157 | uint32_t next = lv2peek(addr) & 0xffffffff; 158 | lv2poke(addr, (uint64_t) val << 32 | next); 159 | } 160 | 161 | void _poke(uint64_t addr, uint64_t val) 162 | { 163 | lv2poke(0x8000000000000000ULL + addr, val); 164 | } 165 | 166 | void _poke32(uint64_t addr, uint32_t val) 167 | { 168 | pokeq32(0x8000000000000000ULL + addr, val); 169 | } 170 | 171 | void lv2memcpy( uint64_t to, const uint64_t from, size_t sz) 172 | { 173 | system_call_3(15, to, from, sz); 174 | } 175 | 176 | void lv2memset( uint64_t dst, const uint64_t val, size_t sz) 177 | { 178 | system_call_3(16, dst, val, sz); 179 | } 180 | -------------------------------------------------------------------------------- /stuff/FullRamdumper/core.h: -------------------------------------------------------------------------------- 1 | 2 | #define PEEKLV1 8 3 | #define POKELV1 9 4 | 5 | #define CELL_FS_SEEK_SET SEEK_SET 6 | #define CELL_FS_SEEK_CUR SEEK_CUR 7 | #define CELL_FS_SEEK_END SEEK_END 8 | 9 | #define REBOOT 0x200 10 | #define SHUTDOWN 0x100 11 | 12 | #define S_IFMT 00170000 13 | #define CELL_FS_O_RDONLY 0 14 | #define CELL_OK 0 15 | #define CELL_FS_O_RDWR 2 16 | #define CELL_FS_O_WRONLY 1 17 | #define CELL_FS_O_ACCMODE 3 18 | #define CELL_FS_O_CREAT 100 19 | #define CELL_FS_O_EXCL 200 20 | #define CELL_FS_O_TRUNC 1000 21 | #define CELL_FS_O_APPEND 2000 22 | #define CELL_FS_O_MSELF 10000 23 | #define CELL_FS_DEFAULT_CREATE_MODE_6 0x186 24 | 25 | #define FILE_SYSTEM_OPEN 801 26 | #define FILE_SYSTEM_READ 802 27 | #define FILE_SYSTEM_WRITE 803 28 | #define FILE_SYSTEM_CLOSE 804 29 | #define FILE_SYSTEM_OPENDIR 805 30 | #define FILE_SYSTEM_READDIR 806 31 | #define FILE_SYSTEM_CLOSEDIR 807 32 | #define FILE_SYSTEM_STAT 808 33 | #define FILE_SYSTEM_MKDIR 811 34 | #define FILE_SYSTEM_FSTAT 809 35 | #define FILE_SYSTEM_UNLINK 814 36 | #define FILE_SYSTEM_LSEEK 818 37 | #define FILE_SYSTEM_FSYNC 820 38 | #define FILE_SYSTEM_MOUNT 837 39 | #define FILE_SYSTEM_UNMOUNT 838 40 | #define FILE_SYSTEM_CHMOD 834 41 | 42 | #define ERROR_KERNEL_509 0x80010509 43 | #define ERROR_KERNEL_CANT_ALLOC_MEMORY 0x80010004 44 | #define ERROR_KERNEL_INVALID_ARGUMENT 0x80010002 45 | #define ERROR_KERNEL_IOERROR 0x8001002B 46 | #define ERROR_KERNEL_NO_RESOURCE 0x80010005 47 | #define ERROR_KERNEL_INVALID_MEMORY 0x8001000D 48 | #define ID_NOR 0x100000200000004 49 | 50 | int RebootShutdownMachine(int command); 51 | int lv2FsChMode(char* path, int mode); 52 | int lv2FsOpen(const char* path, uint64_t flags, int* fd, uint64_t special, const void* arg, uint64_t size); 53 | int lv2FsRead(int fd, char* buffer, uint64_t size, uint64_t* bytes); 54 | int lv2FsWrite(int fd, void* buffer, uint64_t size, uint64_t* bytes); 55 | int lv2FsClose(int fd); 56 | int lv2FsOpenDir(const char* path, int* fd); 57 | int lv2FsCloseDir(int fd); 58 | int lv2FsUnLink(const char* path); 59 | int lv2FsLseek(int fd, int64_t offset, int whence, uint64_t *pos); 60 | int lv2FsFSync(int fd); 61 | void WriteLogInit(uint32_t close, const char* unit, const char *fmt, ...); 62 | int lv2_sm_ring_buzzer(uint64_t unknown1, uint8_t unknown2, uint32_t unknown3); 63 | uint64_t lv1Peek(uint64_t addr); 64 | void lv1Poke(uint64_t addr, uint64_t opcode); 65 | uint64_t lv2peek(uint64_t addr); 66 | void lv2poke(uint64_t addr, uint64_t val); 67 | void pokeq32(uint64_t addr, uint32_t val); 68 | void _poke(uint64_t addr, uint64_t val); 69 | void _poke32(uint64_t addr, uint32_t val); 70 | void lv2memcpy( uint64_t to, const uint64_t from, size_t sz); 71 | void lv2memset( uint64_t dst, const uint64_t val, size_t sz); 72 | void lv1_poke_8(uint64_t addr, uint8_t val); 73 | void lv1_memcpy_to(uint64_t addr, const void *data, unsigned int size); 74 | -------------------------------------------------------------------------------- /stuff/FullRamdumper/main.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #include "core.h" 8 | 9 | int main(void) 10 | { 11 | uint64_t Valor; 12 | uint64_t x=0,i=0; 13 | char *buffer; 14 | 15 | unsigned char buffer_dump[0x200]; 16 | int fd1; 17 | 18 | lv2FsOpen("/dev_hdd0/PS3_RAM.bin", CELL_FS_O_RDWR | CELL_FS_O_CREAT, &fd1, CELL_FS_DEFAULT_CREATE_MODE_6, 0, 0); 19 | 20 | for (i=0;i< (256 * 1024 * 1024);i+= 0x200) 21 | { 22 | for (x=0; x < 0x200; x+=0x8) 23 | { 24 | Valor= lv1Peek(x+i); 25 | memcpy(buffer_dump+x, &Valor, 8); 26 | } 27 | lv2FsWrite(fd1, buffer_dump, 0x200, 0); 28 | } 29 | 30 | lv2FsClose(fd1); 31 | 32 | return 0; 33 | } 34 | -------------------------------------------------------------------------------- /stuff/FullRamdumper/make.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | make.exe 3 | pause -------------------------------------------------------------------------------- /stuff/htab-dumper/421-dex-htab-F000000/PS3_HTAB.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/IngPereira/DynarecPS3/bd36250e2e0391cc90fccbc292f755f466e4d827/stuff/htab-dumper/421-dex-htab-F000000/PS3_HTAB.bin -------------------------------------------------------------------------------- /stuff/htab-dumper/Makefile: -------------------------------------------------------------------------------- 1 | # SCE CONFIDENTIAL 2 | # PlayStation(R)3 Programmer Tool Runtime Library 370.001 3 | # Copyright (C) 2007 Sony Computer Entertainment Inc. 4 | # All Rights Reserved. 5 | 6 | CELL_SDK ?= /usr/local/cell 7 | CELL_MK_DIR ?= $(CELL_SDK)/samples/mk 8 | include $(CELL_MK_DIR)/sdk.makedef.mk 9 | 10 | PPU_SRCS = main.c core.c 11 | PPU_TARGET = EBOOT.ELF 12 | 13 | PPU_INCDIRS += -I$(CELL_TARGET_PATH)/include/ 14 | PPU_CFLAGS += -g -Wpadded -Wall -Wformat=0 15 | PPU_LDLIBS += -lio_stub -lm -lfs_stub -lsysutil_stub -lsysmodule_stub 16 | 17 | include $(CELL_MK_DIR)/sdk.target.mk 18 | -------------------------------------------------------------------------------- /stuff/htab-dumper/core.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #include "core.h" 8 | 9 | int log = -1; 10 | 11 | int RebootShutdownMachine(int command) 12 | { 13 | system_call_3(379, command, 0, 0); 14 | return_to_user_prog(uint64_t); 15 | } 16 | 17 | int lv2FsChMode(char* path, int mode) 18 | { 19 | system_call_2(FILE_SYSTEM_CHMOD, (uint64_t)path, (uint64_t)mode); 20 | return_to_user_prog(uint64_t); 21 | } 22 | 23 | int lv2FsOpen(const char* path, uint64_t flags, int* fd, uint64_t special, const void* arg, uint64_t size) 24 | { 25 | system_call_6(FILE_SYSTEM_OPEN, (uint64_t)path, flags, (uint64_t)fd, special, (uint64_t)arg, size); 26 | return_to_user_prog(uint64_t); 27 | } 28 | 29 | int lv2FsRead(int fd, char* buffer, uint64_t size, uint64_t* bytes) 30 | { 31 | uint64_t temp_bytes; 32 | 33 | system_call_4(FILE_SYSTEM_READ, (uint64_t)fd, (uint64_t)buffer, size, !bytes ? (uint64_t)&temp_bytes : (uint64_t)bytes); 34 | return_to_user_prog(uint64_t); 35 | } 36 | 37 | int lv2FsWrite(int fd, void* buffer, uint64_t size, uint64_t* bytes) 38 | { 39 | uint64_t temp_bytes; 40 | 41 | system_call_4(FILE_SYSTEM_WRITE, (uint64_t)fd, (uint64_t)buffer, size, !bytes ? (uint64_t)&temp_bytes : (uint64_t)bytes); 42 | return_to_user_prog(uint64_t); 43 | } 44 | 45 | int lv2FsClose(int fd) 46 | { 47 | system_call_1(FILE_SYSTEM_CLOSE, (uint64_t)fd); 48 | return_to_user_prog(uint64_t); 49 | } 50 | 51 | int lv2FsOpenDir(const char* path, int* fd) 52 | { 53 | int result = ERROR_KERNEL_INVALID_MEMORY; 54 | if(path && fd) 55 | { 56 | system_call_2(FILE_SYSTEM_OPENDIR, (uint64_t)path, (uint64_t)fd); 57 | return_to_user_prog(uint64_t); 58 | } 59 | 60 | return result; 61 | } 62 | 63 | int lv2FsCloseDir(int fd) 64 | { 65 | system_call_1(FILE_SYSTEM_CLOSEDIR, (uint64_t)fd); 66 | return_to_user_prog(uint64_t); 67 | } 68 | 69 | int lv2FsUnLink(const char* path) 70 | { 71 | system_call_1(FILE_SYSTEM_UNLINK, (uint64_t)path); 72 | return_to_user_prog(uint64_t); 73 | } 74 | 75 | int lv2FsLseek(int fd, int64_t offset, int whence, uint64_t *pos) 76 | { 77 | if(pos) 78 | { 79 | system_call_4(FILE_SYSTEM_LSEEK, (uint64_t)fd, (uint64_t)offset, (uint64_t)whence, (uint64_t)pos); 80 | return_to_user_prog(uint64_t); 81 | } 82 | 83 | return ERROR_KERNEL_INVALID_MEMORY; 84 | } 85 | 86 | int lv2FsFSync(int fd) 87 | { 88 | system_call_1(FILE_SYSTEM_FSYNC, (uint64_t)fd); 89 | return_to_user_prog(uint64_t); 90 | } 91 | 92 | void WriteLogInit(uint32_t close, const char* unit, const char *fmt, ...) 93 | { 94 | int err; 95 | va_list list; 96 | char msg[256]; 97 | 98 | if(log == -1 && unit) 99 | { 100 | sprintf(msg, "%s/APP.log", unit); 101 | lv2FsUnLink(msg); 102 | err = lv2FsOpen(msg,CELL_FS_O_RDWR | CELL_FS_O_CREAT | LV2_O_APPEND, &log, CELL_FS_DEFAULT_CREATE_MODE_6, 0, 0); 103 | lv2FsChMode(msg, S_IFMT | 0777); 104 | if(err != CELL_OK) 105 | { 106 | log = -1; 107 | return; 108 | } 109 | } 110 | 111 | va_start(list, fmt); 112 | vsprintf(msg, fmt, list); 113 | va_end(list); 114 | 115 | if(log != -1) 116 | { 117 | lv2FsWrite(log, msg, strlen(msg), NULL); 118 | lv2FsFSync(log); 119 | if(close) 120 | { 121 | lv2FsClose(log); 122 | log = -1; 123 | } 124 | } 125 | } 126 | 127 | int lv2_sm_ring_buzzer(uint64_t unknown1, uint8_t unknown2, uint32_t unknown3) 128 | { 129 | system_call_3(392, unknown1, unknown2, unknown3); 130 | return_to_user_prog(uint64_t); 131 | } 132 | 133 | uint64_t lv1Peek(uint64_t addr) 134 | { 135 | system_call_1(PEEKLV1, addr); 136 | return_to_user_prog(uint64_t); 137 | } 138 | 139 | void lv1Poke(uint64_t addr, uint64_t opcode) 140 | { 141 | system_call_2(POKELV1, addr, opcode); 142 | } 143 | 144 | uint64_t lv2peek(uint64_t addr) 145 | { 146 | system_call_1(6, addr); 147 | return_to_user_prog(uint64_t); 148 | } 149 | 150 | void lv2poke(uint64_t addr, uint64_t val) 151 | { 152 | system_call_2(7, addr, val); 153 | } 154 | 155 | void pokeq32(uint64_t addr, uint32_t val) 156 | { 157 | uint32_t next = lv2peek(addr) & 0xffffffff; 158 | lv2poke(addr, (uint64_t) val << 32 | next); 159 | } 160 | 161 | void _poke(uint64_t addr, uint64_t val) 162 | { 163 | lv2poke(0x8000000000000000ULL + addr, val); 164 | } 165 | 166 | void _poke32(uint64_t addr, uint32_t val) 167 | { 168 | pokeq32(0x8000000000000000ULL + addr, val); 169 | } 170 | 171 | void lv2memcpy( uint64_t to, const uint64_t from, size_t sz) 172 | { 173 | system_call_3(15, to, from, sz); 174 | } 175 | 176 | void lv2memset( uint64_t dst, const uint64_t val, size_t sz) 177 | { 178 | system_call_3(16, dst, val, sz); 179 | } 180 | -------------------------------------------------------------------------------- /stuff/htab-dumper/core.h: -------------------------------------------------------------------------------- 1 | 2 | #define PEEKLV1 8 3 | #define POKELV1 9 4 | #define LV1_GET_VERSION_INFO 0x7F 5 | #define LV1_PANIC 0xFF 6 | #define GET_SYSTEM_PARAMETER 0x17C 7 | #define DEVICE_SERVICE_SYSTEM_RETRIEVER 0x363 8 | #define DEVICE_GET_PS_CODE_COMMAND 0x19004 9 | 10 | #define CELL_FS_SEEK_SET SEEK_SET 11 | #define CELL_FS_SEEK_CUR SEEK_CUR 12 | #define CELL_FS_SEEK_END SEEK_END 13 | 14 | #define REBOOT 0x200 15 | #define SHUTDOWN 0x100 16 | 17 | #define S_IFMT 00170000 18 | #define LV2_O_RDONLY 0 19 | #define LV2_O_WRONLY 1 20 | #define LV2_O_RDWR 2 21 | #define LV2_O_ACCMODE 3 22 | #define LV2_O_CREAT 100 23 | #define LV2_O_EXCL 200 24 | #define LV2_O_TRUNC 1000 25 | #define LV2_O_APPEND 2000 26 | #define LV2_O_MSELF 10000 27 | #define CELL_FS_O_RDONLY 0 28 | #define CELL_OK 0 29 | #define CELL_FS_O_RDWR 2 30 | #define CELL_FS_O_CREAT 100 31 | #define CELL_FS_DEFAULT_CREATE_MODE_6 0x186 32 | 33 | #define FILE_SYSTEM_OPEN 801 34 | #define FILE_SYSTEM_READ 802 35 | #define FILE_SYSTEM_WRITE 803 36 | #define FILE_SYSTEM_CLOSE 804 37 | #define FILE_SYSTEM_OPENDIR 805 38 | #define FILE_SYSTEM_READDIR 806 39 | #define FILE_SYSTEM_CLOSEDIR 807 40 | #define FILE_SYSTEM_STAT 808 41 | #define FILE_SYSTEM_MKDIR 811 42 | #define FILE_SYSTEM_FSTAT 809 43 | #define FILE_SYSTEM_UNLINK 814 44 | #define FILE_SYSTEM_LSEEK 818 45 | #define FILE_SYSTEM_FSYNC 820 46 | #define FILE_SYSTEM_MOUNT 837 47 | #define FILE_SYSTEM_UNMOUNT 838 48 | #define FILE_SYSTEM_CHMOD 834 49 | #define FLASH1 1 50 | #define FLASH2 2 51 | #define FLASH3 3 52 | #define FLASH4 4 53 | #define WRITE_NO_PROTECTED 0 54 | #define WRITE_PROTECTED 1 55 | #define MAX_USB_RETRY_MOUNT 5 56 | #define RAW_MODE 1 57 | #define NORMAL_MODE 0 58 | 59 | #define ERROR_KERNEL_509 0x80010509 60 | #define ERROR_KERNEL_CANT_ALLOC_MEMORY 0x80010004 61 | #define ERROR_KERNEL_INVALID_ARGUMENT 0x80010002 62 | #define ERROR_KERNEL_IOERROR 0x8001002B 63 | #define ERROR_KERNEL_NO_RESOURCE 0x80010005 64 | #define ERROR_KERNEL_INVALID_MEMORY 0x8001000D 65 | #define ID_NOR 0x100000200000004 66 | 67 | int RebootShutdownMachine(int command); 68 | int lv2FsChMode(char* path, int mode); 69 | int lv2FsOpen(const char* path, uint64_t flags, int* fd, uint64_t special, const void* arg, uint64_t size); 70 | int lv2FsRead(int fd, char* buffer, uint64_t size, uint64_t* bytes); 71 | int lv2FsWrite(int fd, void* buffer, uint64_t size, uint64_t* bytes); 72 | int lv2FsClose(int fd); 73 | int lv2FsOpenDir(const char* path, int* fd); 74 | int lv2FsCloseDir(int fd); 75 | int lv2FsUnLink(const char* path); 76 | int lv2FsLseek(int fd, int64_t offset, int whence, uint64_t *pos); 77 | int lv2FsFSync(int fd); 78 | void WriteLogInit(uint32_t close, const char* unit, const char *fmt, ...); 79 | int lv2_sm_ring_buzzer(uint64_t unknown1, uint8_t unknown2, uint32_t unknown3); 80 | uint64_t lv1Peek(uint64_t addr); 81 | void lv1Poke(uint64_t addr, uint64_t opcode); 82 | uint64_t lv2peek(uint64_t addr); 83 | void lv2poke(uint64_t addr, uint64_t val); 84 | void pokeq32(uint64_t addr, uint32_t val); 85 | void _poke(uint64_t addr, uint64_t val); 86 | void _poke32(uint64_t addr, uint32_t val); 87 | void lv2memcpy( uint64_t to, const uint64_t from, size_t sz); 88 | void lv2memset( uint64_t dst, const uint64_t val, size_t sz); 89 | void lv1_poke_8(uint64_t addr, uint8_t val); 90 | void lv1_memcpy_to(uint64_t addr, const void *data, unsigned int size); 91 | -------------------------------------------------------------------------------- /stuff/htab-dumper/main.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #include "core.h" 8 | 9 | #define HTAB_BASE 0x800000000f000000ULL // works as is on 3.55m, 3.56 but something is wrong in 4.21 10 | 11 | int main(void) 12 | { 13 | int fd; 14 | 15 | lv2FsOpen("/dev_hdd0/PS3_HTAB.bin", CELL_FS_O_RDWR | CELL_FS_O_CREAT | LV2_O_APPEND, &fd, 0x186, 0, 0); 16 | 17 | uint64_t result_lv2; 18 | char* tmp = (char*)malloc(0x80000); 19 | 20 | if(tmp && fd != -1) 21 | { 22 | uint64_t i; 23 | for(i = 0; i < 0x80000; i+=8) 24 | { 25 | result_lv2 = lv2peek(HTAB_BASE + i); 26 | memcpy(tmp + i, &result_lv2, 8); 27 | } 28 | 29 | lv2FsWrite(fd, tmp, 0x80000, NULL); 30 | lv2FsClose(fd); 31 | fd = -1; 32 | 33 | free(tmp); 34 | } 35 | 36 | return 0; 37 | } 38 | -------------------------------------------------------------------------------- /stuff/htab-dumper/make.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | make.exe 3 | pause -------------------------------------------------------------------------------- /stuff/hvcall-htab-fix-permissions/Makefile: -------------------------------------------------------------------------------- 1 | # SCE CONFIDENTIAL 2 | # PlayStation(R)3 Programmer Tool Runtime Library 370.001 3 | # Copyright (C) 2007 Sony Computer Entertainment Inc. 4 | # All Rights Reserved. 5 | 6 | CELL_SDK ?= /usr/local/cell 7 | CELL_MK_DIR ?= $(CELL_SDK)/samples/mk 8 | include $(CELL_MK_DIR)/sdk.makedef.mk 9 | 10 | PPU_SRCS = main.c hvcall.c core.c 11 | PPU_TARGET = EBOOT.ELF 12 | 13 | PPU_INCDIRS += -I$(CELL_TARGET_PATH)/include/ 14 | PPU_CFLAGS += -g -Wpadded -Wall -Wformat=0 15 | PPU_LDLIBS += -lio_stub -lm -lfs_stub -lsysutil_stub -lsysmodule_stub 16 | 17 | include $(CELL_MK_DIR)/sdk.target.mk 18 | -------------------------------------------------------------------------------- /stuff/hvcall-htab-fix-permissions/common.h: -------------------------------------------------------------------------------- 1 | 2 | #define HVSC_SYSCALL 811 // which syscall to overwrite with hvsc redirect 3 | #define HVSC_SYSCALL_ADDR 0x80000000001BC490ULL // 4.21 dex 4 | 5 | #define SYSCALL_TABLE 0x800000000037A1B0ULL //4.21 dex 6 | #define SYSCALL_PTR(n) (SYSCALL_TABLE + 8 * (n)) 7 | -------------------------------------------------------------------------------- /stuff/hvcall-htab-fix-permissions/core.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #include "core.h" 8 | 9 | int log = -1; 10 | 11 | int RebootShutdownMachine(int command) 12 | { 13 | system_call_3(379, command, 0, 0); 14 | return_to_user_prog(uint64_t); 15 | } 16 | 17 | int lv2FsChMode(char* path, int mode) 18 | { 19 | system_call_2(FILE_SYSTEM_CHMOD, (uint64_t)path, (uint64_t)mode); 20 | return_to_user_prog(uint64_t); 21 | } 22 | 23 | int lv2FsOpen(const char* path, uint64_t flags, int* fd, uint64_t special, const void* arg, uint64_t size) 24 | { 25 | system_call_6(FILE_SYSTEM_OPEN, (uint64_t)path, flags, (uint64_t)fd, special, (uint64_t)arg, size); 26 | return_to_user_prog(uint64_t); 27 | } 28 | 29 | int lv2FsRead(int fd, char* buffer, uint64_t size, uint64_t* bytes) 30 | { 31 | uint64_t temp_bytes; 32 | 33 | system_call_4(FILE_SYSTEM_READ, (uint64_t)fd, (uint64_t)buffer, size, !bytes ? (uint64_t)&temp_bytes : (uint64_t)bytes); 34 | return_to_user_prog(uint64_t); 35 | } 36 | 37 | int lv2FsWrite(int fd, void* buffer, uint64_t size, uint64_t* bytes) 38 | { 39 | uint64_t temp_bytes; 40 | 41 | system_call_4(FILE_SYSTEM_WRITE, (uint64_t)fd, (uint64_t)buffer, size, !bytes ? (uint64_t)&temp_bytes : (uint64_t)bytes); 42 | return_to_user_prog(uint64_t); 43 | } 44 | 45 | int lv2FsClose(int fd) 46 | { 47 | system_call_1(FILE_SYSTEM_CLOSE, (uint64_t)fd); 48 | return_to_user_prog(uint64_t); 49 | } 50 | 51 | int lv2FsOpenDir(const char* path, int* fd) 52 | { 53 | int result = ERROR_KERNEL_INVALID_MEMORY; 54 | if(path && fd) 55 | { 56 | system_call_2(FILE_SYSTEM_OPENDIR, (uint64_t)path, (uint64_t)fd); 57 | return_to_user_prog(uint64_t); 58 | } 59 | 60 | return result; 61 | } 62 | 63 | int lv2FsCloseDir(int fd) 64 | { 65 | system_call_1(FILE_SYSTEM_CLOSEDIR, (uint64_t)fd); 66 | return_to_user_prog(uint64_t); 67 | } 68 | 69 | int lv2FsUnLink(const char* path) 70 | { 71 | system_call_1(FILE_SYSTEM_UNLINK, (uint64_t)path); 72 | return_to_user_prog(uint64_t); 73 | } 74 | 75 | int lv2FsLseek(int fd, int64_t offset, int whence, uint64_t *pos) 76 | { 77 | if(pos) 78 | { 79 | system_call_4(FILE_SYSTEM_LSEEK, (uint64_t)fd, (uint64_t)offset, (uint64_t)whence, (uint64_t)pos); 80 | return_to_user_prog(uint64_t); 81 | } 82 | 83 | return ERROR_KERNEL_INVALID_MEMORY; 84 | } 85 | 86 | int lv2FsFSync(int fd) 87 | { 88 | system_call_1(FILE_SYSTEM_FSYNC, (uint64_t)fd); 89 | return_to_user_prog(uint64_t); 90 | } 91 | 92 | void WriteLogInit(uint32_t close, const char* unit, const char *fmt, ...) 93 | { 94 | int err; 95 | va_list list; 96 | char msg[256]; 97 | 98 | if(log == -1 && unit) 99 | { 100 | sprintf(msg, "%s/APP.log", unit); 101 | lv2FsUnLink(msg); 102 | err = lv2FsOpen(msg,CELL_FS_O_RDWR | CELL_FS_O_CREAT | LV2_O_APPEND, &log, CELL_FS_DEFAULT_CREATE_MODE_6, 0, 0); 103 | lv2FsChMode(msg, S_IFMT | 0777); 104 | if(err != CELL_OK) 105 | { 106 | log = -1; 107 | return; 108 | } 109 | } 110 | 111 | va_start(list, fmt); 112 | vsprintf(msg, fmt, list); 113 | va_end(list); 114 | 115 | if(log != -1) 116 | { 117 | lv2FsWrite(log, msg, strlen(msg), NULL); 118 | lv2FsFSync(log); 119 | if(close) 120 | { 121 | lv2FsClose(log); 122 | log = -1; 123 | } 124 | } 125 | } 126 | 127 | int lv2_sm_ring_buzzer(uint64_t unknown1, uint8_t unknown2, uint32_t unknown3) 128 | { 129 | system_call_3(392, unknown1, unknown2, unknown3); 130 | return_to_user_prog(uint64_t); 131 | } 132 | 133 | uint64_t lv1Peek(uint64_t addr) 134 | { 135 | system_call_1(PEEKLV1, addr); 136 | return_to_user_prog(uint64_t); 137 | } 138 | 139 | void lv1Poke(uint64_t addr, uint64_t opcode) 140 | { 141 | system_call_2(POKELV1, addr, opcode); 142 | } 143 | 144 | uint64_t lv2peek(uint64_t addr) 145 | { 146 | system_call_1(6, addr); 147 | return_to_user_prog(uint64_t); 148 | } 149 | 150 | void lv2poke(uint64_t addr, uint64_t val) 151 | { 152 | system_call_2(7, addr, val); 153 | } 154 | 155 | void pokeq32(uint64_t addr, uint32_t val) 156 | { 157 | uint32_t next = lv2peek(addr) & 0xffffffff; 158 | lv2poke(addr, (uint64_t) val << 32 | next); 159 | } 160 | 161 | void _poke(uint64_t addr, uint64_t val) 162 | { 163 | lv2poke(0x8000000000000000ULL + addr, val); 164 | } 165 | 166 | void _poke32(uint64_t addr, uint32_t val) 167 | { 168 | pokeq32(0x8000000000000000ULL + addr, val); 169 | } 170 | 171 | void lv2memcpy( uint64_t to, const uint64_t from, size_t sz) 172 | { 173 | system_call_3(15, to, from, sz); 174 | } 175 | 176 | void lv2memset( uint64_t dst, const uint64_t val, size_t sz) 177 | { 178 | system_call_3(16, dst, val, sz); 179 | } 180 | -------------------------------------------------------------------------------- /stuff/hvcall-htab-fix-permissions/core.h: -------------------------------------------------------------------------------- 1 | 2 | #define PEEKLV1 8 3 | #define POKELV1 9 4 | #define LV1_GET_VERSION_INFO 0x7F 5 | #define LV1_PANIC 0xFF 6 | #define GET_SYSTEM_PARAMETER 0x17C 7 | #define DEVICE_SERVICE_SYSTEM_RETRIEVER 0x363 8 | #define DEVICE_GET_PS_CODE_COMMAND 0x19004 9 | 10 | #define CELL_FS_SEEK_SET SEEK_SET 11 | #define CELL_FS_SEEK_CUR SEEK_CUR 12 | #define CELL_FS_SEEK_END SEEK_END 13 | 14 | #define REBOOT 0x200 15 | #define SHUTDOWN 0x100 16 | 17 | #define S_IFMT 00170000 18 | #define LV2_O_RDONLY 0 19 | #define LV2_O_WRONLY 1 20 | #define LV2_O_RDWR 2 21 | #define LV2_O_ACCMODE 3 22 | #define LV2_O_CREAT 100 23 | #define LV2_O_EXCL 200 24 | #define LV2_O_TRUNC 1000 25 | #define LV2_O_APPEND 2000 26 | #define LV2_O_MSELF 10000 27 | #define CELL_FS_O_RDONLY 0 28 | #define CELL_OK 0 29 | #define CELL_FS_O_RDWR 2 30 | #define CELL_FS_O_CREAT 100 31 | #define CELL_FS_DEFAULT_CREATE_MODE_6 0x186 32 | 33 | #define FILE_SYSTEM_OPEN 801 34 | #define FILE_SYSTEM_READ 802 35 | #define FILE_SYSTEM_WRITE 803 36 | #define FILE_SYSTEM_CLOSE 804 37 | #define FILE_SYSTEM_OPENDIR 805 38 | #define FILE_SYSTEM_READDIR 806 39 | #define FILE_SYSTEM_CLOSEDIR 807 40 | #define FILE_SYSTEM_STAT 808 41 | #define FILE_SYSTEM_MKDIR 811 42 | #define FILE_SYSTEM_FSTAT 809 43 | #define FILE_SYSTEM_UNLINK 814 44 | #define FILE_SYSTEM_LSEEK 818 45 | #define FILE_SYSTEM_FSYNC 820 46 | #define FILE_SYSTEM_MOUNT 837 47 | #define FILE_SYSTEM_UNMOUNT 838 48 | #define FILE_SYSTEM_CHMOD 834 49 | #define FLASH1 1 50 | #define FLASH2 2 51 | #define FLASH3 3 52 | #define FLASH4 4 53 | #define WRITE_NO_PROTECTED 0 54 | #define WRITE_PROTECTED 1 55 | #define MAX_USB_RETRY_MOUNT 5 56 | #define RAW_MODE 1 57 | #define NORMAL_MODE 0 58 | 59 | #define ERROR_KERNEL_509 0x80010509 60 | #define ERROR_KERNEL_CANT_ALLOC_MEMORY 0x80010004 61 | #define ERROR_KERNEL_INVALID_ARGUMENT 0x80010002 62 | #define ERROR_KERNEL_IOERROR 0x8001002B 63 | #define ERROR_KERNEL_NO_RESOURCE 0x80010005 64 | #define ERROR_KERNEL_INVALID_MEMORY 0x8001000D 65 | #define ID_NOR 0x100000200000004 66 | 67 | int RebootShutdownMachine(int command); 68 | int lv2FsChMode(char* path, int mode); 69 | int lv2FsOpen(const char* path, uint64_t flags, int* fd, uint64_t special, const void* arg, uint64_t size); 70 | int lv2FsRead(int fd, char* buffer, uint64_t size, uint64_t* bytes); 71 | int lv2FsWrite(int fd, void* buffer, uint64_t size, uint64_t* bytes); 72 | int lv2FsClose(int fd); 73 | int lv2FsOpenDir(const char* path, int* fd); 74 | int lv2FsCloseDir(int fd); 75 | int lv2FsUnLink(const char* path); 76 | int lv2FsLseek(int fd, int64_t offset, int whence, uint64_t *pos); 77 | int lv2FsFSync(int fd); 78 | void WriteLogInit(uint32_t close, const char* unit, const char *fmt, ...); 79 | int lv2_sm_ring_buzzer(uint64_t unknown1, uint8_t unknown2, uint32_t unknown3); 80 | uint64_t lv1Peek(uint64_t addr); 81 | void lv1Poke(uint64_t addr, uint64_t opcode); 82 | uint64_t lv2peek(uint64_t addr); 83 | void lv2poke(uint64_t addr, uint64_t val); 84 | void pokeq32(uint64_t addr, uint32_t val); 85 | void _poke(uint64_t addr, uint64_t val); 86 | void _poke32(uint64_t addr, uint32_t val); 87 | void lv2memcpy( uint64_t to, const uint64_t from, size_t sz); 88 | void lv2memset( uint64_t dst, const uint64_t val, size_t sz); 89 | void lv1_poke_8(uint64_t addr, uint8_t val); 90 | void lv1_memcpy_to(uint64_t addr, const void *data, unsigned int size); 91 | -------------------------------------------------------------------------------- /stuff/hvcall-htab-fix-permissions/hvcall.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | #include "hvcall.h" 6 | #include "core.h" 7 | 8 | void hvsc_redirect(uint8_t hvcall, uint8_t opt) 9 | { 10 | int x; 11 | 12 | uint64_t original_syscall_code_1 = lv2peek(HVSC_SYSCALL_ADDR); 13 | uint64_t original_syscall_code_2 = lv2peek(HVSC_SYSCALL_ADDR + 8); 14 | uint64_t original_syscall_code_3 = lv2peek(HVSC_SYSCALL_ADDR + 16); 15 | uint64_t original_syscall_code_4 = lv2peek(HVSC_SYSCALL_ADDR + 24); 16 | 17 | // Install redirect 18 | if(opt == 0) 19 | { 20 | for (x=0;x<25;x++) 21 | { 22 | lv2poke(HVSC_SYSCALL_ADDR, 0x7C0802A6F8010010ULL); 23 | lv2poke(HVSC_SYSCALL_ADDR + 8, 0x3960000044000022ULL | (uint64_t)hvcall << 32); 24 | lv2poke(HVSC_SYSCALL_ADDR + 16, 0xE80100107C0803A6ULL); 25 | lv2poke(HVSC_SYSCALL_ADDR + 24, 0x4e80002060000000ULL); 26 | __asm__("sync"); 27 | } 28 | } 29 | if(opt == 1) // Remove redirections 30 | { 31 | for (x=0;x<25;x++) 32 | { 33 | lv2poke(HVSC_SYSCALL_ADDR, original_syscall_code_1); 34 | lv2poke(HVSC_SYSCALL_ADDR + 8, original_syscall_code_2); 35 | lv2poke(HVSC_SYSCALL_ADDR + 16, original_syscall_code_3); 36 | lv2poke(HVSC_SYSCALL_ADDR + 24, original_syscall_code_4); 37 | __asm__("sync"); 38 | } 39 | } 40 | 41 | } 42 | 43 | int lv1_write_htab_entry(uint64_t vas_id, uint64_t slot, uint64_t va, uint64_t pa) 44 | { 45 | hvsc_redirect(1,1); // redirect to hvcall 1 46 | 47 | // call lv1_write_htab_entry 48 | uint64_t ret = 0; 49 | 50 | __asm__ __volatile__("mr %%r3, %1;" "mr %%r4, %2;" "mr %%r5, %3;" 51 | "mr %%r6, %4;" 52 | SYSCALL(HVSC_SYSCALL) "mr %0, %%r3;":"=r"(ret) 53 | :"r"(vas_id), "r"(slot), "r"(va), 54 | "r"(pa) 55 | :"r0", "r2", "r3", "r4", "r5", "r6", "r7", "r8", 56 | "r9", "r10", "r11", "r12", "lr", "ctr", "xer", 57 | "cr0", "cr1", "cr5", "cr6", "cr7", "memory"); 58 | 59 | hvsc_redirect(1, 0); // Now remove hvsc redirections 60 | 61 | WriteLogInit(0,NULL,"APP: call lv1_write_htab_entry OK!\n");; 62 | 63 | // Just one return r3 64 | return (int)ret; 65 | } 66 | 67 | int patch_htabfix() 68 | { 69 | int i, res; 70 | uint64_t pte0, pte1; 71 | 72 | // process entire lv2 73 | for (i = 0; i < 128; i++) 74 | { 75 | // read the old value 76 | pte0 = lv2peek(HTAB_BASE | (i << 7)); 77 | pte1 = lv2peek(HTAB_BASE | (i << 7) + 8); 78 | 79 | WriteLogInit(0,NULL,"APP: %d loop\n",i);; 80 | 81 | WriteLogInit(0,NULL,"APP: pte0: 0x%016llx\n", pte0);; 82 | 83 | WriteLogInit(0,NULL,"APP: pte1: 0x%016llx\n", pte1);; 84 | 85 | //verify entry is lv2 86 | if ((pte1 >= HTAB_LV2_START) && (pte1 < HTAB_LV2_END)) 87 | { 88 | // patch proper htab settings 89 | res = lv1_write_htab_entry( 0, i << 3, pte0, (pte1 & 0xff0000) | 0x190 ); 90 | } 91 | } 92 | 93 | WriteLogInit(0,NULL,"APP: Htab parcheado OK!\n");; 94 | 95 | return res; 96 | 97 | } 98 | -------------------------------------------------------------------------------- /stuff/hvcall-htab-fix-permissions/hvcall.h: -------------------------------------------------------------------------------- 1 | 2 | /* 3.55 | 3.56 CEX 3 | #define HTAB_BASE 0x800000000f000000ULL 4 | #define HTAB_LV2_START 0x01000000ULL // LV2 START OFFSET on RAM 5 | #define HTAB_LV2_END 0x01800000ULL // LV2 END 6 | */ 7 | 8 | // 4.21 DEX (TESTED) 9 | #define HTAB_BASE 0x800000000f000000ULL 10 | #define HTAB_LV2_START 0x08000000ULL // LV2 START OFFSET ON RAM 11 | #define HTAB_LV2_END 0x08800000ULL // LV2 END (Being 0x800000 the size) 12 | 13 | #define HVSC_SYSCALL 811 // which syscall to overwrite with hvsc redirect 14 | #define HVSC_SYSCALL_ADDR 0x80000000001BC490ULL // 4.21 dex -- replaces sys_fs_mkdir, later we remove it. 15 | #define SC_QUOTE_(x) #x 16 | #define SYSCALL(num) "li %%r11, " SC_QUOTE_(num) "; sc;" 17 | 18 | void hvsc_redirect(uint8_t hvcall, uint8_t opt); 19 | int lv1_write_htab_entry(uint64_t vas_id, uint64_t slot, uint64_t va, uint64_t pa); 20 | int patch_htabfix(void); 21 | -------------------------------------------------------------------------------- /stuff/hvcall-htab-fix-permissions/main.c: -------------------------------------------------------------------------------- 1 | /* SCE CONFIDENTIAL */ 2 | /* PlayStation(R)3 Programmer Tool Runtime Library 370.001 */ 3 | /* Copyright (C) 2007 Sony Computer Entertainment Inc. */ 4 | /* All Rights Reserved. */ 5 | 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | //SYS_PROCESS_PARAM(1001, 0x10000); 14 | 15 | #include "core.h" 16 | 17 | #define HV_HASH_OFFSET 0x370A28 18 | 19 | int main(void) 20 | { 21 | int result; 22 | char unitdbg[]={"/dev_hdd0"}; 23 | 24 | WriteLogInit(0,unitdbg,"APP: Running main base!\n");; 25 | 26 | // Patch LV2 LV1 HASH 27 | lv1Poke(HV_HASH_OFFSET, 1); 28 | lv1Poke(HV_HASH_OFFSET + 8, 0xE0D251B556C59F05ULL); 29 | lv1Poke(HV_HASH_OFFSET + 16, 0xC232FCAD552C80D7ULL); 30 | lv1Poke(HV_HASH_OFFSET + 24, 0x65140CD200000000ULL); 31 | 32 | result = patch_htabfix(); 33 | 34 | WriteLogInit(1,NULL,"APP: hv_call Result: %d!\n", result);; 35 | 36 | lv2_sm_ring_buzzer(0x1004, 0xa, 0x1b6); 37 | 38 | return 0; 39 | } 40 | -------------------------------------------------------------------------------- /stuff/hvcall-htab-fix-permissions/make.bat: -------------------------------------------------------------------------------- 1 | @echo off 2 | make.exe 3 | pause -------------------------------------------------------------------------------- /tools/APP.conf: -------------------------------------------------------------------------------- 1 | ContentID = IV0002-DYNA00001_00-SAMPLE0000000001 2 | K_licensee = 0x72F990788F9CFF745725F08E4C128387 3 | DRM_Type = Free 4 | Content_Type = Game_Exec 5 | PackageVersion = 01.00 -------------------------------------------------------------------------------- /tools/cygwin1.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/IngPereira/DynarecPS3/bd36250e2e0391cc90fccbc292f755f466e4d827/tools/cygwin1.dll -------------------------------------------------------------------------------- /tools/psn_package_npdrm.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/IngPereira/DynarecPS3/bd36250e2e0391cc90fccbc292f755f466e4d827/tools/psn_package_npdrm.exe -------------------------------------------------------------------------------- /tools/scetool.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/IngPereira/DynarecPS3/bd36250e2e0391cc90fccbc292f755f466e4d827/tools/scetool.exe -------------------------------------------------------------------------------- /tools/zlib1.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/IngPereira/DynarecPS3/bd36250e2e0391cc90fccbc292f755f466e4d827/tools/zlib1.dll --------------------------------------------------------------------------------