forums.ps2dev.org Forum Index forums.ps2dev.org
Homebrew PS2, PSP & PS3 Development Discussions
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

hooking sceNetInetRecvfrom from vsh

 
Post new topic   Reply to topic    forums.ps2dev.org Forum Index -> PSP Development
View previous topic :: View next topic  
Author Message
bbtgp32465



Joined: 18 Sep 2009
Posts: 24
PostPosted: Tue Nov 10, 2009 10:46 pm    Post subject: hooking sceNetInetRecvfrom from vsh Reply with quote
I really don't like asking for help but this problem has completely defeated me.

The problem is that vsh loads the net librarys in a different partition then normal game mode.

e.g.

Code:
VSH Memory Partitions:
N  |    BASE    |   SIZE   | TOTALFREE |  MAXFREE  | ATTR |
---|------------|----------|-----------|-----------|------|
1  | 0x88000000 |  6291456 |   2437120 |   1892608 | 000C |
2  | 0x08800000 | 50331648 |  24467456 |  23653632 | 000F |
3  | 0x88000000 |  6291456 |   2437120 |   1892608 | 000C |
4  | 0x88600000 |  2097152 |   2097152 |   2097152 | 000C |
5  | 0x0B800000 |  8388608 |   8388608 |   8388608 | 000F |///net librarys
6  | 0x08800000 | 50331648 |  24467456 |  23653632 | 000F |
11 | 0x88000000 |  6291456 |   2437120 |   1892608 | 000C |


Iv tried hooking this from kernel mode using everything i could think of.

lui $t9 0xaddr
ori $t9, $t9, 0xaddr
jr $9
nop

that sort of worked. but i was getting load fetch instruction error so i assumed it did not have access to kernel mode from there.

i tried syscall which also worked but i got this exception:
Code:
Exception - Address load/inst fetch
Thread ID - 0x05167271
Th Name   - SceNpAuthWorker
Module ID - 0x05047115
Mod Name  - sceNet_Library
EPC       - 0x0B803978
Cause     - 0x10000010
BadVAddr  - 0x593E19C3
Status    - 0x00088612
zr:0x00000000 at:0xDEADBEEF v0:0x00000001 v1:0x00000002
a0:0x00000003 a1:0xDEADBEEF a2:0xDEADBEEF a3:0xDEADBEEF
t0:0xDEADBEEF t1:0xDEADBEEF t2:0xDEADBEEF t3:0xDEADBEEF
t4:0xDEADBEEF t5:0xDEADBEEF t6:0xDEADBEEF t7:0xDEADBEEF
s0:0x593E19BB s1:0x0B885654 s2:0x0B810000 s3:0x00000001
s4:0x0B810000 s5:0x00000000 s6:0x00000001 s7:0x0BFF5A60
t8:0xDEADBEEF t9:0xDEADBEEF k0:0x0BFF5F00 k1:0x00000000
gp:0x0B968B90 sp:0x0BFF59A0 fp:0x0B918A58 ra:0x0B803950


and i wasn't able to use fprintf do to a $gp issue. which isn't a big deal.

any one have any ideas? thanks. If no, then im sure ill figure it out eventually, only been 2 days.

edit:
iv also tried in user mode but sctrlHENFindFunction always returns 0x8002013A, only works in kernel
Back to top
View user's profile Send private message
bbtgp32465



Joined: 18 Sep 2009
Posts: 24
PostPosted: Tue Nov 10, 2009 11:42 pm    Post subject: Reply with quote
i got it hooked with out any errors, the only problem is with sctrlHENFindFunction now.
Back to top
View user's profile Send private message
Torch



Joined: 28 May 2008
Posts: 842
PostPosted: Wed Nov 11, 2009 12:11 am    Post subject: Reply with quote
bbtgp32465 wrote:
i got it hooked with out any errors, the only problem is with sctrlHENFindFunction now.


Isn't it only a kernel function? Doesn't have a syscall export IIRC. Make one :)
Though you'll have problems hooking it from user mode after disabling memory protection, depending on what the function is doing.
Back to top
View user's profile Send private message
bbtgp32465



Joined: 18 Sep 2009
Posts: 24
PostPosted: Wed Nov 11, 2009 12:19 am    Post subject: Reply with quote
I believe its loaded in user mode because of the attribute.

5 | 0x0B800000 | 8388608 | 8388608 | 8388608 | 000F |///net librarys
6 | 0x08800000 | 50331648 | 24467456 | 23653632 | 000F |

here is the code i have now, its not done yet. i want to figure out whats going on in psn.

Code:

#include <pspkernel.h>
#include <pspsdk.h>
#include <pspdebug.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <systemctrl.h>
#include <netinet/in.h>
#include <time.h>

#include "intr.h"

PSP_MODULE_INFO("550PSN", 0, 0x0, 0x0);
PSP_MAIN_THREAD_NAME("550PSN");
PSP_HEAP_SIZE_KB(128);

u32 orig_call1[8];
u32 orig_call2[8];
u32 orig_call3[8];
u32 orig_call4[8];

#define LUI(x) (0x3C190000 | (0x0000ffff & x))
#define ORI(x) (0x37390000 | (0x0000ffff & x))
#define JR 0x03200008

ssize_t   (*sceNetInetRecvFromOld)(int s, void *buf, size_t len, int flags, struct sockaddr *from, socklen_t *fromlen);
ssize_t (*sceNetInetRecvOld)(int s, void *buf, size_t len, int flags);

ssize_t sceNetInetRecvFromNew(int s, void *buf, size_t len, int flags, struct sockaddr *from, socklen_t *fromlen)
{
   char name[128];
   sprintf(name, "recDumps/RecvFrom_%d_%d.bin", (int)clock(), len);
   ssize_t res = sceNetInetRecvFromOld(s, buf, len, flags, from, fromlen);
   if(res<=0)
      return res;
   FILE *fp = fopen(name, "w");
   fwrite(buf, res, 1, fp);
   fclose(fp);
   return res;
}

ssize_t sceNetInetRecvNew(int s, void *buf, size_t len, int flags)
{
   char name[128];
   sprintf(name, "recDumps/Recv_%d_%d.bin", (int)clock(), len);
   ssize_t res = sceNetInetRecvOld(s, buf, len, flags);
   if(res<=0)
      return res;
   FILE *fp = fopen(name, "w");
   fwrite(buf, res, 1, fp);
   fclose(fp);
   return res;
}

ssize_t   (*sceNetInetSendOld)(int s, const void *buf, size_t len, int flags);
ssize_t   (*sceNetInetSendtoOld)(int s, const void *buf, size_t len, int flags, const struct sockaddr *to, socklen_t tolen);


ssize_t   sceNetInetSendNew(int s, const void *buf, size_t len, int flags)
{
   char name[128];
   sprintf(name, "sendDumps/Send_%d_%d.bin", (int)clock(), len);
   ssize_t res = sceNetInetSendOld(s, buf, len, flags);
   if(res<=0)
      return res;
   FILE *fp = fopen(name, "w");
   fwrite(buf, res, 1, fp);
   fclose(fp);
   return res;
}

ssize_t   sceNetInetSendtoNew(int s, const void *buf, size_t len, int flags, const struct sockaddr *to, socklen_t tolen)
{
   char name[128];
   sprintf(name, "sendDumps/SendTo_%d_%d.bin", (int)clock(), len);
   ssize_t res = sceNetInetSendtoOld(s, buf, len, flags, to, tolen);
   if(res<=0)
      return res;
   FILE *fp = fopen(name, "w");
   fwrite(buf, res, 1, fp);
   fclose(fp);
   return res;
}

void hook(u32 sfunc, u32 *orig_call, void* func)
{
   orig_call[0] = _lw(sfunc);
   orig_call[1] = _lw(sfunc+4);
   orig_call[2] = _lw(sfunc+8);
   orig_call[3] = _lw(sfunc+12);
   orig_call[4] = LUI((sfunc+16)>>16);
   orig_call[5] = ORI((sfunc+16));
   orig_call[6] = JR;
   orig_call[7] = 0;

   _sw(LUI(((u32)func>>16)),sfunc);
   _sw(ORI((u32)func),sfunc+4);
   _sw(JR,sfunc+8);
   _sw(0,sfunc+12);

}

int main(int argc, char **argv)
{
   //this will only work when psn is loaded for the first time. address will changes afterwords

   sceNetInetRecvFromOld = (void*)orig_call1;
   sceNetInetRecvOld = (void*)orig_call2;
   sceNetInetSendtoOld = (void*)orig_call3;
   sceNetInetSendOld = (void*)orig_call4;

   hook(0x0B8133CC, orig_call1, sceNetInetRecvFromNew);
   hook(0x0B8132F4, orig_call2, sceNetInetRecvNew);
   hook(0x0B812EC8, orig_call3, sceNetInetSendtoNew);
   hook(0x0B812DF4, orig_call4, sceNetInetSendNew);

   sceKernelDcacheWritebackAll();
   sceKernelSleepThread();
   return 0;
}


edit: updated code

got 21 nice receive dumps, on to send functions

edit: updated again, all thats left is to study the dumps.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    forums.ps2dev.org Forum Index -> PSP Development All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group