forums.ps2dev.org

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

sceDisplay:
0x46f186c3 sceDisplayWaitVblankStartCB

IoFileMgrForUser:
0x6d08a871 sceIoUnassign

ThreadManForUser:
0xed1410e0 sceKernelDeleteFpl
0x86255ada sceKernelDeleteMbx
0x56c039b5 sceKernelCreateVpl
0x89b3d48c sceKernelDeleteVpl

ModuleMgrForUser:
0xb7f46618 sceKernelLoadModuleByID

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

ThreadManForUser:
0xc07bb470 sceKernelCreateFpl
0x8125221d sceKernelCreateMbx

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

sceMt19937:
0xecf5d379 sceMt19937Init
0xf40c98e6 sceMt19937UInt

neofar · Joined: 21 Jan 2004 Posts: 47 Location: Spain

Thanks man, but some function are known

Added function names in this modules

- IoFileMgrForUser > http://pspdev.ofcode.com/api.php?type=2&id=43
- ModuleMgrForUser > http://pspdev.ofcode.com/api.php?type=2&id=58
- sceMt19937 > http://pspdev.ofcode.com/api.php?type=2&id=17
- sceOpenPSID > http://pspdev.ofcode.com/api.php?type=2&id=48
- ThreadManForUser > http://pspdev.ofcode.com/api.php?type=2&id=42

Thanks lex

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

a few more

sceNetIfhandle_lib:
0x8fcb05a1 sceNetIfhandleIfUp
0xead3a759 sceNetIfhandleIfDown
0xb1f5bb87 sceNetIfhandleIfStart

sceNetAdhocctl:
0x75ecd386 sceNetAdhocctlGetState

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

sceFpu:

0x1679670e sceFpuPositiveQNaN
0xbbaecb62 sceFpuPositiveSNaN
0xde6648f8 sceFpuNegativeQNaN
0xb5bc35dd sceFpuNegativeSNaN

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

Some new findings:

sceMpeg:
0x874624d6 sceMpegFinish

sceReg:
0x9b25edf1 sceRegExit

sceDisplay:
0xdea197d4 sceDisplayGetMode

sceFont:
0x67f17ed7 sceFontNewLib

sceVideocodec:
0x26927d19 sceVideocodecGetVersion
0x745a7b7a sceVideocodecSetMemory

sceFpu:
0x2d9961ee sceFpuSignFloat
0xab081baf sceFpuSignInt

sceWlan:
0x482cae9a sceWlanDevAttach
0xc9a8cab7 sceWlanDevDetach

sceReg:
0x57641a81 sceRegCreateKey
0x3615bc87 sceRegRemoveKey
0xdeda92bf SemaphoreIPReset ???

Now for the libraries. Most of these hashes appear
in the sce... as well as in the according sce..._lib or sce..._rfc
so I guess they might be the same, and do not neccessarily
follow the sce-naming-scheme.

sce_Http:
0x0282a3bd DisabledBuffBound ???
0xb509b09e HndlrStatusRecive ???
0x87797bdd ParseMaxDestroy ???

sceHttp_rfc:
0xc98cbba7 COPParamReset ???
0x0282a3bd DisabledBuffBound ???
0xb509b09e HndlrStatusRecive ???
0x87797bdd ParseMaxDestroy ???

sceNetApDialogDummy:
0xf213be65 ContentAuthenticationWrapper ???

sceNetAdhoc:
0x9df81198 DownBrokerIdle ???
0x73bfd52d NetKickActive ???

sceNetIfhandle_lib:
0x76bad213 EmptySwitchSetup ???

sceSsl_lib:
0x54a7d8f3 SSL_clear
0x84833472 SSL_free
0xe7c29542 SSL_read
0x3e3133d6 SSL_shutdown
0x104f749d SSL_state
0x57f2e960 SSL_version
0xb7ca8717 SSL_write
0xedbe00d6 sslQueuePing ???
0x1c2728a5 FwdCancelEnabled ???
0x37c7b76c NullPayLoadFilter ???
0xae3986d3 PdpResponseTime ???

scePaf:
0xca79d58b HomeBanRecycle ???

sceNet_lib:
0x5216cbf5 IndexDeDestroy ???

sceNetAdhocctl_lib:
0x1c679240 LinkDiscoverSkip
0x62b875a8 ThreadDisconnectread ???

sceNetInet:
0x805502dd MessageCTXcipher ???

sceNetInet_lib:
0x5155ec8a ArrayDMACParam ???

sceLibFont:
0x3c4b7e82 NameBufMessages ???

ThreadManForUser:
0xb736e9ff NdCookiesSet ???
0x369ed59d acceptCodscePaf ???

sceParseUri:
0x568518c9 SpanSemaphorePriority ???

neofar · Joined: 21 Jan 2004 Posts: 47 Location: Spain

added added added added added added... ufffff
>> http://pspdev.ofcode.com/api.php

kex, get this link to see all NID functions without Name
>> http://pspdev.ofcode.com/get.php?type=funcunk&id=0

...and.... attack!!!!

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

neofar, what about:

sceSsl_lib:
0x54a7d8f3 SSL_clear
0x84833472 SSL_free
0xe7c29542 SSL_read
0x3e3133d6 SSL_shutdown
0x104f749d SSL_state
0x57f2e960 SSL_version
0xb7ca8717 SSL_write

sceNetAdhocctl_lib:
0x1c679240 LinkDiscoverSkip

they sound pretty well to me
and got one more:

sceDisplay:
0xeeda2e54 sceDisplayGetFrameBuf

Lex

neofar · Joined: 21 Jan 2004 Posts: 47 Location: Spain

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

wow a posting form only for me ;-)

I think the non sce-names are used in _lib's and _ref's,
thats why we didn't find much in them yet.

I'll rerun my special dictionary tomorrow against these api's.

What do you think about the equal hashes found in
for example 0x0282a3bd, 0xb509b09e and 0x87797bdd
in sce_Http and sce_Http_rfc ?

The names might be wrong anyway, but interesting don't you think ?

Vampire · Joined: 12 Apr 2005 Posts: 138

sceHttp_rfc is wrong
the APIGroup should be sceHttp

djhuevo · Joined: 10 Mar 2005 Posts: 47

yeah sceHttp_rfc must be sceHttp, we need to figure versioning info to handle it correctly
_________________
sobreviviendo en la tierra de los trolldev

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

Sorry, no sleep tonight, can't wait for your form ;-)

LoadExecForUser:
0xbd2f1094 sceKernelLoadExec

sceNetAdhocAuth_lib:
0x86004235 sceNetAdhocAuthInit
0x6074d8f1 sceNetAdhocAuthTerm

sceNetAdhocDownload:
0x57a51dd0 sceNetAdhocDownloadCreateClient
0x13dab550 sceNetAdhocDownloadCreateServer
0x378d4311 sceNetAdhocDownloadDeleteClient
0x7a483f9e sceNetAdhocDownloadDeleteServer
0x3082f4e2 sceNetAdhocDownloadInitClient
0xa21fef45 sceNetAdhocDownloadInitServer
0xbf1433f0 sceNetAdhocDownloadTermClient
0x117ca01a sceNetAdhocDownloadTermServer

sceNetAdhocctl:
0x5e7f79c9 sceNetAdhocctlJoin

sceNetApDialogDummy:
0xca9be5bf sceNetApDialogDummyGetState
0xbb73ff67 sceNetApDialogDummyInit
0xf213be65 sceNetApDialogDummyTerm

sceNetIfhandle:
0x30602ce9 sceNetIfhandleSignalSema
0xd5da7b3c sceNetIfhandleWaitSema

sceNetInet:
0x4cfe4e56 sceNetInetShutdown

sceSsl:
0x191cdeff sceSslEnd
0x957ecbe2 sceSslInit

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

sceWlanDrv:
0x0c622081 sceWlanGetEtherAddr
0xd7763699 sceWlanGetSwitchState

sceHttp:
0xb3faf831 sceHttpsDisableOption
0xbac31bf1 sceHttpsEnableOption

sceReg:
0xd4475aa8 sceRegGetKeyInfo
0x28a8e98a sceRegGetKeyValue
0x2d211135 sceRegGetKeys
0x17768e14 sceRegSetKeyValue

sceRtc:
0x3f7ad767 sceRtcGetCurrentTick

sceUtility:
0x5eee6548 sceUtilityCheckNetParam

scePower:
0x478fe6f5 scePowerPtrIPS ???

sceFpu:
0x4b113cea sceFpuAUriset ???

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

sceRtc:
0xc41c2853 sceRtcGetTickResolution
0x4cfa57b0 sceRtcGetCurrentClock
0xf2a4afe5 sceRtcTickAddSeconds

and two rather strange ones

sceLibFont:
0xbb8e7fe6 sceFontOpenUserMemory ???

sceMpegbase:
0xbea18f91 sceMpegForwardCodeing ???

neofar · Joined: 21 Jan 2004 Posts: 47 Location: Spain

Hiz lex... look at pm
I have send you the post form ...

and for the rest, in a few days we publish the post system.... now we are testing functionality

mrbrown · Joined: 17 Jan 2004 Posts: 1536

frozon · Joined: 16 May 2005 Posts: 5

Hi.
I'm currently studying for my exam next week so i don't use my computer.
I've compiled the sha attack program for my nunux.
But now i'm wondering how to use it.
If someone can say me where i can find the hash_list dictionaryfirst and dictionarymain i'll run the soft and let it run 24/24.

frozon · Joined: 16 May 2005 Posts: 5

I found something int sceNetAdhocctl

Drakonite · Site Admin Joined: 17 Jan 2004 Posts: 989

frozen: You can't just run the program and expect the output to all real functions -- it's very easy to have fake collisions.

Depending on the dictionary being used you can realistically expect over 95% to be false collisions.
_________________
Shoot Pixels Not People!
Makeshift Development

PspPet · Joined: 30 Mar 2005 Posts: 210

FYI: Semi-related topic - Easy way to find hash-keys - use Kernel Memory Dump
I don't know how people are finding hash keys, but I suspect they are looking at existing programs and their entry stubs.
---
An easy way to get *all* the hash keys for a given library:
Be sure the library is loaded into memory (load it yourself with a few fake entries). Then run the kernel memory dumper (or a modified version of it).

Then look at the memory dump. The libraries are there in kernel memory, with *all* the entries and hash keys. The libraries themselves are in a simple linked list.
I've have over 2000 of them already (most of which aren't in the published lists). I won't bother posting the hashids here since so far I've only found a few names (the name matching/guessing problem has not changed)

Also works for system components that won't be found in regular game programs (like "SysMemForKernel", "LoadExecForKernel" and other goodies like the hardware drivers)
Once these names are found, those names can be used as labels for disassembled code (especially for the kernel components)

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

Frozon:

You got 6 hits, adding to database:

sceNetInet:
sceNetInetRecv 0xcda85c99

ThreadManForUser:
sceKernelSendMbx 0xe9b3061e
sceKernelFreeVpl 0xb736e9ff
sceKernelFreeFpl 0xf6414a71

sceNetIfhandle_lib:
sceNetMGet 0xa493aa5f
sceNetMFree 0xf8825dc4

But please crosscheck the discovered name for similarity with the
prefix of the used hash.
Things like "scetopPowerBody" sound funny but do you really think
programmers will call their function that way ? :-D

If you get more results and are unsure you can send them to me
for pre-check.

Lex

frozon · Joined: 16 May 2005 Posts: 5

Here are some more function.
lex i've checked them it seems ok for the first one the second i have no clue.

Lex · Joined: 11 May 2005 Posts: 27 Location: Germany

Frozon, added the sceFont-one, but take a look 6 or 7 posts before :-D

frozon · Joined: 16 May 2005 Posts: 5

woops sorry lol
I run out of idea in order to complete my dic so i didn't find any new function yet.
I'll give an other look. ;)
It is funny to do this lol

PspPet · Joined: 30 Mar 2005 Posts: 210

Sampling of new "User" entries found by using the system exports technique (looking at what the system provides, not limited to discovered entries used by UMD programs)

PspPet · Joined: 30 Mar 2005 Posts: 210

Very small sample of the System/Kernel entries found by using the system exports technique (culling out the obvious false-positives with a relatively short SHA1 search - items marked with "?")

alonetrio · Joined: 15 May 2005 Posts: 34

here is my little participation :

-*-*-*-*-*-*-*- ATRACT 3 -*-*-*-*-*-*-*-*-*-*

Warren · Joined: 24 Jan 2004 Posts: 173 Location: San Diego, CA

You made a few mistakes in your post here are the corrections: