| View previous topic :: View next topic |
| Author |
Message |
Draan
Joined: 17 Oct 2009
Posts: 55
|
 Posted: Wed Nov 04, 2009 6:41 am Post subject: 3 NIDs - what is this doing? |
 |
|
All I know is:
char* path = SystemCtrlForKernel_AC56B90B(); //returning a string (i'm sure)
SysMemForKernel_C7E57B9C (0x00000E30); //returning nothing or nothing important
unk = SystemCtrlForKernel_F9584CAD (0x00000800); //this is compared with zero in next line
if (!(unk != 0x00000000))
0x00000800 - maybe vsh mode, so it's maybe something like sceKernelCheckModuleAttr(u32 attr)?
Anyone knows what is this? Thanks for help. |
|
| Back to top |
|
 |
a_noob
Joined: 17 Sep 2006
Posts: 97
Location: _start: jr 0xDEADBEEF
|
| Posted: Wed Nov 04, 2009 6:54 am Post subject: |
|
|
Well it says SystemCtrl meaning input, so I assume PSP_CTRL_START = 0x000008 and the function to be int sceCtrl_driver_5E77BC8A (unsigned int mask) which gets the given mask, so this essentially is saying
if PSP_CTRL_START is masked
But I could most certainly be mistaken
_________________
| Code: | .øOº'ºOø.
'ºOo.oOº' |
|
|
| Back to top |
|
|
Draan
Joined: 17 Oct 2009
Posts: 55
|
| Posted: Wed Nov 04, 2009 7:02 am Post subject: |
|
|
| Well, thanks for reply, but I think you're wrong. It's from galaxy.prx, so it's not doing anything with buttons. |
|
| Back to top |
|
|
Davee
Joined: 22 Jun 2009
Posts: 59
|
| Posted: Wed Nov 04, 2009 9:56 am Post subject: |
|
|
That sysmem function is "sceKernelSetQTGP3".
void *SystemCtrlForKernel_F9584CAD(u32 size);
This allocs memory from systemctrl's special heap. Errors when return 0. |
|
| Back to top |
|
|
victorprosa
Joined: 14 Jan 2009
Posts: 38
|
|
| Back to top |
|
|
Draan
Joined: 17 Oct 2009
Posts: 55
|
| Posted: Thu Nov 05, 2009 1:29 am Post subject: |
|
|
Thanks Davee!
Ok, I've created the stubs file for me, and I'll try what's doing the last needed function...
How to find how many and which arguments does the function need?
(I'm noob in reverse engineering, I'm using PSPDecompiler and trying to make something useful with output)
reversed subroutine 0x0000032C (module_start)
| Code: |
int module_start(SceSize args, void *argp)
{
u32* mod = sceKernelFindModuleByName("sceThreadManager");
u32 text_addr = *(mod+27);
_sw(sceKernelCreateThread_fake, text_addr+0x17DEC);
_sw(sceKernelStartThread_fake, text_addr+0x17F88);
clearCache();
while(1){
char* path = SystemCtrlForKernel_AC56B90B(); //here is our function, i'm not sure it's with no arguments
SceUID file = sceIoOpen(path, PSP_O_RDONLY, NULL);
if (file >= 0) break;
sceKernelDelayThread(10000);
}
sceIoClose (file);
return 0;
} |
|
|
| Back to top |
|
|
Draan
Joined: 17 Oct 2009
Posts: 55
|
| Posted: Mon Nov 09, 2009 3:56 am Post subject: |
|
|
I found it!
from hostcore by poison:
getUmdFile = ( void * )findProc( "SystemControl", "SystemCtrlForKernel", 0xAC56B90B );
This is it!
But it isn't sctrlGetUmdFile, nor sctrlSEGetUmdFile, nor getUmdFile...
(cracking nids for dax's functions - yeach) |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
