Function bodies 388 total
RegistrationStrategies class · kotlin · L60-L125 (66 LOC)feature/ps3/src/desktopMain/kotlin/com/my/psremoteplay/feature/ps3/platform/RegistrationStrategy.kt
object RegistrationStrategies {
/**
* Strategy 2: Phone Type (1) with PS4 Formula
* IV Context: PIN as 4-byte BE uint + 4 zeros
* STATUS: TESTED - FAILED (403 Forbidden)
*
* Hypothesis: PS4 registration uses similar pattern, worth testing
* Result: Does not match PS3 registration encryption
*/
val phoneTypePS4Formula = PhoneTypePS4FormulaStrategy()
/**
* Strategy 3: PC Type (2) with PS4 Formula
* IV Context: PIN as 4-byte BE uint + 4 zeros
* Key Material: PIN as 4-byte BE + 12 zeros (PIN-derived)
* STATUS: NEW - From VAIO DLL Analysis
*
* Insight: VRPSDK.dll analysis shows PC type uses PIN-derived key material,
* unlike Phone type which uses random material. Different body structure.
*
* Reference: research/pupps3/ghidra_findings/22_VAIO_DLL_ANALYSIS.md page 312
*/
val pcTypePS4Formula = PCTypePS4FormulaStrategy()
/**
* Strategy 4: Phone Type with 8-Byte BE Longlong
* IIosPs3Dependencies class · kotlin · L27-L92 (66 LOC)feature/ps3/src/iosMain/kotlin/com/my/psremoteplay/feature/ps3/di/IosPs3Dependencies.kt
class IosPs3Dependencies : Ps3Dependencies {
private val logger: Logger = object : Logger {
override fun log(tag: String, message: String) {
println("[$tag] $message")
}
override fun error(tag: String, message: String, throwable: Throwable?) {
println("[$tag] ERROR: $message${throwable?.let { " - ${it.message}" } ?: ""}")
}
}
override val streaming: StreamingDependencies = object : StreamingDependencies {
override val crypto: Crypto = object : Crypto {
override fun aesEncrypt(data: ByteArray, key: ByteArray, iv: ByteArray): ByteArray =
error("Not implemented")
override fun aesDecrypt(data: ByteArray, key: ByteArray, iv: ByteArray): ByteArray =
error("Not implemented")
override fun base64Encode(data: ByteArray): String =
error("Not implemented")
override fun base64Decode(data: String): ByteArray =
errun method · java · L23-L32 (10 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
protected void run() throws Exception {
// Create Ps3 data structure types
Ps3DataStructureTypes.createStructureTypes();
// Initialise utils
utils = new Ps3ElfUtils(this, currentProgram);
// Process program
process();
}handlePrx method · java · L34-L37 (4 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void handlePrx() throws Exception {
println("Processing PRX");
createModuleInfo();
}handleExec method · java · L39-L92 (54 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void handleExec() throws Exception {
println("Processing EXEC");
final Data elfData = getDataAt(utils.getElfHeader().getStart());
final long elfEntryPtr = elfData.getComponent(11).getLong(0); // e_entry
printf("e_entry: %X\n", elfEntryPtr);
Address opdAddress = currentAddress.getNewAddress(0);
long opdSize = 0;
boolean foundOpd = false;
// Heuristic to find OPD section: we assume it's the one that the entry point
// pointer is in
for (int i = 1; i < utils.getSections().size(); ++i) {
if (elfEntryPtr < utils.getSections().get(i).getvAddr()) {
final ElfSection opdSection = utils.getSections().get(i - 1);
opdAddress = currentAddress.getNewAddress(opdSection.getvAddr());
opdSize = opdSection.getSize();
foundOpd = true;
break;
}
}
if (!foundOpd) {
println("Could notprocess method · java · L94-L103 (10 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void process() throws Exception {
if(utils.loadingPrx()) {
handlePrx();
} else if(utils.loadingExec()) {
handleExec();
} else {
println("Unknown program detected type: "+String.format("0x%08X", utils.findPs3ProgramType()));
}
}applyProcessInfo method · java · L105-L153 (49 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void applyProcessInfo() throws Exception {// https://github.com/aerosoul94/ida_gel/blob/master/src/ps3/cell_loader.cpp#L669
final Address phdrArrayAddress = utils.getPhdrArrayAddress();
println("Reading PHDR array at "+phdrArrayAddress);
final Data phdr_array = getDataAt(phdrArrayAddress);
println(phdr_array.getDataType()+"");
for (int i = 0; i < phdr_array.getNumComponents(); i++) {
println("phdr "+i);
final Data phdr = phdr_array.getComponent(i);
final int p_type = phdr.getComponent(0).getInt(0);
long p_vaddr = phdr.getComponent(3).getLong(0);
long p_filesz = phdr.getComponent(5).getLong(0);
if (p_type == Ps3ElfUtils.PT_PROC_PARAM) {
println("TODO sys_process_param_t");
if(p_vaddr == 0) {
// TODO psp stuff seems blanked, possibly same with vsh
println("Section seems blanked, ignoring");Powered by Repobility — scan your code at https://repobility.com
addFunction method · java · L155-L157 (3 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void addFunction(Address funcStart) throws Exception {
addFunctionImpl(funcStart, "");
}addFunctionImpl method · java · L163-L176 (14 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void addFunctionImpl(Address funcStart, String funcName) throws Exception {
if (!disassemble(funcStart)) {
printf("failed to disasm at %X\n", funcStart.getOffset());
return;
}
if (getFunctionAt(funcStart) == null) {
Function func = createFunction(funcStart, null);
if (func == null) {
printf("failed to create func at %X\n", funcStart.getOffset());
} else if (!funcName.equals("")) {
func.setName(funcName, SourceType.ANALYSIS);
}
}
}createFunctionsFromOPD method · java · L178-L191 (14 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createFunctionsFromOPD(Address opdAddr, long opdSize) throws Exception {
Address addr = opdAddr;
for (long i = 0; i < opdSize; i += 8) {
final Address funcAddressPtr = opdAddr.add(i);
utils.applyDataForce(Pointer32DataType.dataType, "", funcAddressPtr);
Data data = getDataAt(funcAddressPtr);
Address funcAddress = (Address) data.getValue();
addFunction(funcAddress);
final Address funcTocAddress = opdAddr.add(i + 4);
utils.applyDataForce(Pointer32DataType.dataType, "", funcTocAddress);
}
}findExports method · java · L193-L231 (39 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void findExports() throws Exception {
boolean found = false;
for (MemoryBlock block : currentProgram.getMemory().getBlocks()) {
if (!block.isInitialized()) {
continue;
}
if(block.getSize() < 0x1C * 2) {
if(block.getSize() == 0x1C) {
final int structSize = block.getByte(block.getStart()) & 0xff;
if(structSize == 0x1C) {
createImportStubsFromMemoryBlock(block);
found = true;
break;
}
}
continue;
}
final Address sectaddr = block.getStart();
final int structsize = block.getByte(sectaddr) & 0xff;
if(structsize > block.getSize()) {
continue;
}
final int structsize2 = block.getByte(sectaddr.add(structsize)) & 0xff;
if(structsize == strfindImports method · java · L233-L273 (41 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void findImports() throws Exception {
boolean found = false;
for (MemoryBlock block : currentProgram.getMemory().getBlocks()) {
if (!block.isInitialized()) {
continue;
}
if(block.getSize() < 0x2c * 2) {
if(block.getSize() == 0x2c) {
final int structsize = block.getByte(block.getStart()) & 0xff;
if(structsize == 0x2c) {
createImportStubsFromMemoryBlock(block);
found = true;
break;
}
}
continue;
}
final Address sectaddr = block.getStart();
final int structsize = block.getByte(sectaddr) & 0xff;
if(structsize > block.getSize()) {
continue;
}
final int structsize2 = block.getByte(sectaddr.add(structsize)) & 0xff;
if(structsize == strcreateModuleInfo method · java · L275-L300 (26 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createModuleInfo() throws Exception {
// Try and get elf header (why isnt this exposed as a getter..)
final MemoryBlock elfProgramHeaders = currentProgram.getMemory().getBlock("_elfProgramHeaders");
final Address start = elfProgramHeaders.getStart();
final Data dataAt = getDataAt(start);
if (!dataAt.isArray()) {
println("Expected data array");
return;
}
final Data firstProgHeader = dataAt.getComponent(0);//Get first program header
final long p_offset = firstProgHeader.getLong(0x8);
final long p_paddr = firstProgHeader.getLong(0x18);
final long module_info_offset = p_paddr - p_offset;
final Address module_info_addr = currentAddress.getNewAddress(module_info_offset);
utils.applyStruct(Ps3DataStructureTypes.sceModuleInfoPpu32DataType, module_info_addr);
printf("module_info offset = 0x%X\n", module_info_offset);
createExportEntsFromModsetR2FromModuleInfo method · java · L302-L306 (5 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void setR2FromModuleInfo(Address module_info_addr) throws Exception {
final Data module_info = getDataAt(module_info_addr);
final int gp_value = module_info.getComponent(1).getInt(0);//gp_value
setR2(gp_value);
}setR2 method · java · L308-L318 (11 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void setR2(int toc) throws Exception {
final Register r2 = currentProgram.getProgramContext().getRegister("r2");
// TODO find the correct segment to mark and use opd toc values
for (MemoryBlock block : currentProgram.getMemory().getBlocks()) {
currentProgram.getProgramContext().setRegisterValue(block.getStart(), block.getEnd(), new RegisterValue(r2, new BigInteger(""+toc)));
}
createLabel(currentAddress.getNewAddress(toc), "TOC_BASE", true);
printf("Toc / R2 set to 0x%08X\n", toc);
}If a scraper extracted this row, it came from Repobility (https://repobility.com)
createImportStubsFromMemoryBlock method · java · L321-L330 (10 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createImportStubsFromMemoryBlock(MemoryBlock block) throws Exception {
final long stub_count = block.getSize() / Ps3DataStructureTypes.sceLibStubPpu32DataType.getLength();
println("Entries = "+stub_count+" size="+block.getSize()+" struct_size="+Ps3DataStructureTypes.sceLibStubPpu32DataType.getLength());
if(stub_count == 0) {
println("No imports");
return;
}
createImportStubs(block.getStart(), (int) stub_count);
}createImportStubsFromModuleInfo method · java · L333-L349 (17 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createImportStubsFromModuleInfo(Address module_info_addr) throws Exception {
final Data module_info = getDataAt(module_info_addr);
final long stub_top = module_info.getComponent(4).getInt(0);
final long stub_end = module_info.getComponent(5).getInt(0);
final long stub_size = stub_end - stub_top;
final long stub_count = stub_size / Ps3DataStructureTypes.sceLibStubPpu32DataType.getLength();
println("Entries = "+stub_count+" size="+stub_size+" struct_size="+Ps3DataStructureTypes.sceLibStubPpu32DataType.getLength());
if(stub_count == 0) {
//Can happen, eg libL10n
println("No imports");
return;
}
createImportStubs(currentAddress.getNewAddress(stub_top), (int) stub_count);
}createImportStubsFromPrxInfo method · java · L351-L364 (14 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createImportStubsFromPrxInfo(Address prxInfo_addr) throws Exception {
final Data sys_process_prx_info_t = getDataAt(prxInfo_addr);
final long stub_top = sys_process_prx_info_t.getComponent(6).getInt(0);
final long stub_end = sys_process_prx_info_t.getComponent(7).getInt(0);
final long stub_size = stub_end - stub_top;
final long stub_count = stub_size / Ps3DataStructureTypes.sceLibStubPpu32DataType.getLength();
println("Entries = "+stub_count+" size="+stub_size+" struct_size="+Ps3DataStructureTypes.sceLibStubPpu32DataType.getLength());
if(stub_count == 0) {
println("No imports");
return;
}
createImportStubs(currentAddress.getNewAddress(stub_top), (int) stub_count);
}createImportStubsFromRange method · java · L366-L375 (10 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createImportStubsFromRange(Address start, Address end) throws Exception {
final long stub_count = (end.getOffset() - start.getOffset()) / Ps3DataStructureTypes.sceLibStubPpu32DataType.getLength();
if(stub_count == 0) {
println("No imports");
return;
}
createImportStubs(start, (int) stub_count);
}createImportStubs method · java · L377-L504 (128 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createImportStubs(Address start_addr, int stub_count) throws Exception {
utils.applyStructArray(Ps3DataStructureTypes.sceLibStubPpu32DataType, stub_count, start_addr);
// TODO loop through and mark the entries with the lib name etc?
// TODO mark fnids / pointer tables
final Data libStubArray = getDataAt(start_addr);//sceLibStubPpu32DataType array
for (int i = 0; i < libStubArray.getNumComponents(); i++) {
final Data libStubData = libStubArray.getComponent(i);
printf("\n");
printf("libStubData addr 0x%S\n", libStubData.getAddress());
final long namePtr = libStubData.getComponent(1).getInt(0);//libname ptr
final long funcNidTablePtr = libStubData.getComponent(2).getInt(0);
final long funcTablePtr = libStubData.getComponent(3).getInt(0);
final long varNidTablePtr = libStubData.getComponent(4).getInt(0);
final long varTablePtr = libStubcreateExportEntsFromMemoryBlock method · java · L506-L515 (10 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createExportEntsFromMemoryBlock(MemoryBlock block) throws Exception {
final long ent_count = block.getSize() / Ps3DataStructureTypes.sceLibEntPpu32DataType.getLength();
println("Entries = "+ent_count+" size="+block.getSize()+" struct_size="+Ps3DataStructureTypes.sceLibEntPpu32DataType.getLength());
if(ent_count == 0) {
println("No exports");
return;
}
createExportEnts(block.getStart(), (int) ent_count);
}createExportEntsFromModuleInfo method · java · L517-L527 (11 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createExportEntsFromModuleInfo(Address module_info_addr) throws Exception {
final Data module_info = getDataAt(module_info_addr);
final long ent_top = module_info.getComponent(2).getInt(0);
final long ent_end = module_info.getComponent(3).getInt(0);
final long ent_size = ent_end - ent_top;
final long ent_count = ent_size / Ps3DataStructureTypes.sceLibEntPpu32DataType.getLength();
println("Entries = "+ent_count+" size="+ent_size+" struct_size="+Ps3DataStructureTypes.sceLibEntPpu32DataType.getLength());
createExportEnts(currentAddress.getNewAddress(ent_top), (int) ent_count);
}createExportEntsFromPrxInfo method · java · L529-L542 (14 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createExportEntsFromPrxInfo(Address prxInfo_addr) throws Exception {
final Data sys_process_prx_info_t = getDataAt(prxInfo_addr);
final long ent_top = sys_process_prx_info_t.getComponent(4).getInt(0);
final long ent_end = sys_process_prx_info_t.getComponent(5).getInt(0);
final long ent_size = ent_end - ent_top;
final long ent_count = ent_size / Ps3DataStructureTypes.sceLibEntPpu32DataType.getLength();
println("Entries = "+ent_count+" size="+ent_size+" struct_size="+Ps3DataStructureTypes.sceLibEntPpu32DataType.getLength());
if(ent_count == 0) {
println("No exports");
return;
}
createExportEnts(currentAddress.getNewAddress(ent_top), (int) ent_count);
}Repobility · severity-and-effort ranking · https://repobility.com
createExportEntsFromRange method · java · L544-L553 (10 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createExportEntsFromRange(Address start, Address end) throws Exception {
final long stub_count = (end.getOffset() - start.getOffset()) / Ps3DataStructureTypes.sceLibEntPpu32DataType.getLength();
if(stub_count == 0) {
println("No exports");
return;
}
createExportEnts(start, (int) stub_count);
}createExportEnts method · java · L555-L662 (108 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
private void createExportEnts(Address start_addr, int exportCount) throws Exception {//Exports
final Address ent_top_addr = start_addr;
utils.applyStructArray(Ps3DataStructureTypes.sceLibEntPpu32DataType, exportCount, ent_top_addr);
//TODO loop through and mark the entries with the lib name etc?
//TODO mark fnids / pointer tables
final Data libEntArray = getDataAt(ent_top_addr);//_scelibent_ppu32 array
for (int i = 0; i < libEntArray.getNumComponents(); i++) {
final Data libEntData = libEntArray.getComponent(i);
printf("libEntData addr 0x%S\n", libEntData.getAddress());
final long namePtr = libEntData.getComponent(1).getInt(0);//libname ptr
final long nidTablePtr = libEntData.getComponent(2).getInt(0);
final long addTablePtr = libEntData.getComponent(3).getInt(0);
String libname = "NONAME";
if(namePtr != 0) {
final Address namePtr_getPlugin method · java · L664-L674 (11 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AnalyzePs3Binary.java
public static <T extends Plugin> T getPlugin(PluginTool tool, Class<T> c) {
List<Plugin> list = tool.getManagedPlugins();
Iterator<Plugin> it = list.iterator();
while (it.hasNext()) {
Plugin p = it.next();
if (p.getClass() == c) {
return c.cast(p);
}
}
return null;
}AssignPs3R2FromOpd class · java · L18-L143 (126 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AssignPs3R2FromOpd.java
public class AssignPs3R2FromOpd extends GhidraScript {
private List<ElfSection> sections = new ArrayList<>();
MemoryBlock elfHeader = null;
private short getType() throws Exception {
//Find elf header block
for (MemoryBlock block : currentProgram.getMemory().getBlocks()) {
final Data dataAt = getDataAt(block.getStart());
if(dataAt != null && dataAt.getDataType().getName().equals("Elf64_Ehdr")) {
elfHeader = block;
break;
}
}
if(elfHeader == null) {
printerr("Couldn't find Elf64_Ehdr\n");
return -1;
}
return getDataAt(elfHeader.getStart()).getComponent(8).getShort(0);//e_type
}
@Override
protected void run() throws Exception {
process();
}
boolean loadingExec() throws Exception {
return getType() == ET_EXEC;
}
private void parseSections(Data elfData) throws Exception {
final int getType method · java · L23-L39 (17 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AssignPs3R2FromOpd.java
private short getType() throws Exception {
//Find elf header block
for (MemoryBlock block : currentProgram.getMemory().getBlocks()) {
final Data dataAt = getDataAt(block.getStart());
if(dataAt != null && dataAt.getDataType().getName().equals("Elf64_Ehdr")) {
elfHeader = block;
break;
}
}
if(elfHeader == null) {
printerr("Couldn't find Elf64_Ehdr\n");
return -1;
}
return getDataAt(elfHeader.getStart()).getComponent(8).getShort(0);//e_type
}run method · java · L42-L44 (3 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AssignPs3R2FromOpd.java
protected void run() throws Exception {
process();
}loadingExec method · java · L46-L48 (3 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AssignPs3R2FromOpd.java
boolean loadingExec() throws Exception {
return getType() == ET_EXEC;
}parseSections method · java · L50-L74 (25 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AssignPs3R2FromOpd.java
private void parseSections(Data elfData) throws Exception {
final int sectionCount = elfData.getComponent(19).getShort(0); // e_shnum
Address sectHdrAddr = currentAddress.getNewAddress(0);
for (MemoryBlock block : currentProgram.getMemory().getBlocks()) {
println(block.getName());
if (block.getName().equals("_elfSectionHeaders")) {
sectHdrAddr = block.getStart();
break;
}
}
final Data sectHdr = getDataAt(sectHdrAddr);
for (int shIdx = 0; shIdx < sectionCount; ++shIdx) {
final Data shData = sectHdr.getComponent(shIdx);
final long shAddr = shData.getComponent(3).getLong(0);
final long shSize = shData.getComponent(5).getLong(0);
ElfSection newSection = new ElfSection(shAddr, shSize);
sections.add(newSection);
}
}Repobility · code-quality intelligence · https://repobility.com
process method · java · L77-L136 (60 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AssignPs3R2FromOpd.java
private void process() throws Exception {
if (!loadingExec()) {
// TODO handle finding opd in prxs
println("Wrong type of file");
return;
}
final Data elfData = getDataAt(elfHeader.getStart());
final long elfEntryPtr = elfData.getComponent(11).getLong(0); // e_entry
parseSections(elfData);
boolean foundOpd = false;
Address opdAddress = null;
long opdSize = 0;
// Heuristic to find OPD section: we assume it's the one that the entry point
// pointer is in
for (int i = 1; i < sections.size(); ++i) {
if (elfEntryPtr < sections.get(i).getvAddr()) {
final ElfSection opdSection = sections.get(i - 1);
opdAddress = currentAddress.getNewAddress(opdSection.getvAddr());
opdSize = opdSection.getSize();
foundOpd = true;
break;
}
}
if (!foundOpd) {
setFunctionR2 method · java · L138-L141 (4 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/AssignPs3R2FromOpd.java
private void setFunctionR2(Function function, int toc) throws Exception {
final Register r2 = currentProgram.getProgramContext().getRegister("r2");
currentProgram.getProgramContext().setRegisterValue(function.getBody().getMinAddress(), function.getBody().getMaxAddress(), new RegisterValue(r2, new BigInteger(""+toc)));
}DefinePS3Syscalls class · java · L56-L302 (247 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/DefinePS3Syscalls.java
public class DefinePS3Syscalls extends GhidraScript {
// disassembles to "CALL dword ptr GS:[0x10]"
private static final byte[] ppc64_bytes = {0x44, 0x00, 0x00, 0x02};
private static final String powerPC = "PowerPC";
private static final String SYSCALL_SPACE_NAME = "SYSCALLS";
private static final int SYSCALL_SPACE_LENGTH = 1024; // 0x10000
// tests whether an instruction is making a system call
private Predicate<Instruction> tester;
// register holding the syscall number
private String syscallRegister;
/**
* Checks whether an instruction is a system call
*
* @param inst instruction to check
* @return true precisely when the instruction is a system call
*/
private static boolean checkInstruction(Instruction inst) {
try {
return Arrays.equals(ppc64_bytes, inst.getBytes());
} catch (MemoryAccessException e) {
Msg.info(DefinePS3Syscalls.class, "MemoryAccessException at " + icheckInstruction method · java · L79-L86 (8 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/DefinePS3Syscalls.java
private static boolean checkInstruction(Instruction inst) {
try {
return Arrays.equals(ppc64_bytes, inst.getBytes());
} catch (MemoryAccessException e) {
Msg.info(DefinePS3Syscalls.class, "MemoryAccessException at " + inst.getAddress().toString());
return false;
}
}run method · java · L89-L205 (117 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/DefinePS3Syscalls.java
protected void run() throws Exception {
if (!(currentProgram.getExecutableFormat().equals(ElfLoader.ELF_NAME) &&
currentProgram.getLanguage().getProcessor().toString().equals(powerPC))) {
popup("This script is intended for PS3 files");
return;
}
final Address syscallTableAddr = currentProgram.getAddressFactory().getAddress("0x8000000");
MemoryBlock syscallBlock = currentProgram.getMemory().getBlock(SYSCALL_SPACE_NAME);
if (syscallBlock == null) {
syscallBlock = MemoryBlockUtils.createUninitializedBlock(currentProgram, false, SYSCALL_SPACE_NAME, syscallTableAddr, SYSCALL_SPACE_LENGTH, "PS3 Syscalls", null, true, true, true, null);
}
//determine whether the executable is 32 or 64 bit and set fields appropriately
tester = DefinePS3Syscalls::checkInstruction;
syscallRegister = "r11";
// datatype archive containing signature of system calls
StringetSyscallNumberMap method · java · L208-L233 (26 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/DefinePS3Syscalls.java
private Map<Long, String> getSyscallNumberMap() {
Map<Long, String> syscallMap = new HashMap<>();
File file = new File(Ps3ElfUtils.getExtensionInstallDataPath("Ps3GhidraScripts"), "data/syscall.txt");
if (!file.exists()) {
try {
file = askFile("Locate syscall.txt", "Accept");
} catch (Exception e) {
Msg.showError(this, null, "Error reading syscall map file", e.getMessage(), e);
return syscallMap;
}
}
try (FileReader fReader = new FileReader(file); BufferedReader bReader = new BufferedReader(fReader)) {
String line;
while ((line = bReader.readLine()) != null) {
//lines starting with # are comments
if (!line.startsWith("#")) {
String[] parts = line.trim().split(" ");
Long number = Long.parseLong(parts[0]);
syscallMap.put(number, parts[1]);
getSyscallsInFunctions method · java · L245-L267 (23 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/DefinePS3Syscalls.java
private Map<Function, Set<Address>> getSyscallsInFunctions(Program program, TaskMonitor tMonitor) throws CancelledException {
Map<Function, Set<Address>> funcsToCalls = new HashMap<>();
for (Function func : program.getFunctionManager().getFunctionsNoStubs(true)) {
tMonitor.checkCanceled();
AddressSetView functionAddressRange = func.getBody();
if (functionAddressRange.getMinAddress().equals(functionAddressRange.getMaxAddress())) {
println("Function " + func.getName() + " at " + func.getEntryPoint() + " Doesn't look like its defined correctly :c .. (Try clear flow and repair!)");
}
for (Instruction inst : program.getListing().getInstructions(functionAddressRange, true)) {
if (tester.test(inst)) {
Set<Address> callSites = funcsToCalls.get(func);
if (callSites == null) {
callSites = new HashSet<>();
resolveConstants method · java · L279-L300 (22 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/DefinePS3Syscalls.java
private Map<Address, Long> resolveConstants(Map<Function, Set<Address>> funcsToCalls, Program program, TaskMonitor tMonitor) throws CancelledException {
// Sometimes this doesn't find all SC's :|
Map<Address, Long> addressesToSyscalls = new HashMap<>();
Register syscallReg = program.getLanguage().getRegister(syscallRegister);
for (Function func : funcsToCalls.keySet()) {
Address start = func.getEntryPoint();
ContextEvaluator eval = new ConstantPropagationContextEvaluator(tMonitor, true);
SymbolicPropogator symEval = new SymbolicPropogator(program);
symEval.flowConstants(start, func.getBody(), eval, true, tMonitor);
for (Address callSite : funcsToCalls.get(func)) {
Value val = symEval.getRegisterValue(callSite, syscallReg);
if (val == null) {
createBookmark(callSite, "System Call",
"Couldn't resolve value of " + sPowered by Repobility — scan your code at https://repobility.com
ElfSection class · java · L1-L23 (23 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/ElfSection.java
class ElfSection implements Comparable<ElfSection> {
private long vAddr;
private long size;
public ElfSection(long vAddr, long size) {
this.vAddr = vAddr;
this.size = size;
}
public long getvAddr() {
return vAddr;
}
public long getSize() {
return size;
}
public int compareTo(ElfSection compareElfSection) {
return (int) (this.vAddr - compareElfSection.vAddr);
}
}ElfSection method · java · L6-L9 (4 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/ElfSection.java
public ElfSection(long vAddr, long size) {
this.vAddr = vAddr;
this.size = size;
}getvAddr method · java · L11-L13 (3 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/ElfSection.java
public long getvAddr() {
return vAddr;
}getSize method · java · L15-L17 (3 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/ElfSection.java
public long getSize() {
return size;
}compareTo method · java · L19-L21 (3 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/ElfSection.java
public int compareTo(ElfSection compareElfSection) {
return (int) (this.vAddr - compareElfSection.vAddr);
}FnidUtils class · java · L9-L48 (40 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/FnidUtils.java
class FnidUtils {
private static final String NIDS_PATH = "nids.txt";
private static HashMap<String, String> fnids = null;
public static String getNameForFnid(GhidraScript script, String moduleName, int fnid) throws Exception {
if(fnids == null) {
loadFnids(script);
}
if(moduleName.equals("NONAME")) {
moduleName = "";
}
final String fnidHex = String.format("0x%08X", fnid);
String name = fnids.get(fnidHex);
if(name == null) {
script.printf("Missing fnid, module: %s %s\n", moduleName, fnidHex);
return moduleName+"_"+fnidHex;
}
return name;
}
private static void loadFnids(GhidraScript script) throws Exception {
fnids = new HashMap<>();
File file = new File(Ps3ElfUtils.getExtensionInstallDataPath("Ps3GhidraScripts"), "data/"+NIDS_PATH);
if (!file.exists()) {
file = script.askFile("Locate nids.txt", "Load");
getNameForFnid method · java · L14-L32 (19 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/FnidUtils.java
public static String getNameForFnid(GhidraScript script, String moduleName, int fnid) throws Exception {
if(fnids == null) {
loadFnids(script);
}
if(moduleName.equals("NONAME")) {
moduleName = "";
}
final String fnidHex = String.format("0x%08X", fnid);
String name = fnids.get(fnidHex);
if(name == null) {
script.printf("Missing fnid, module: %s %s\n", moduleName, fnidHex);
return moduleName+"_"+fnidHex;
}
return name;
}loadFnids method · java · L34-L46 (13 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/FnidUtils.java
private static void loadFnids(GhidraScript script) throws Exception {
fnids = new HashMap<>();
File file = new File(Ps3ElfUtils.getExtensionInstallDataPath("Ps3GhidraScripts"), "data/"+NIDS_PATH);
if (!file.exists()) {
file = script.askFile("Locate nids.txt", "Load");
}
List<String> list = FileUtils.readLines(file,Charset.defaultCharset());
for (String s : list) {
final String[] split = s.split(" ");
fnids.put(split[0], split[1]);
}
}If a scraper extracted this row, it came from Repobility (https://repobility.com)
Ps3DataStructureTypes class · java · L3-L175 (173 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/Ps3DataStructureTypes.java
class Ps3DataStructureTypes {
public static void createStructureTypes() {
//Module info
createSceModuleInfoCommonDataStruc();
createSceModuleInfoPpu32Struc();
createSceModuleInfoPpu64Struc();
//Imports
createSceLibStubCommonStruc();
createSceLibStubPpu32Struc();
createSceLibStubPpu64Struc();
//Exports
createSceLibEntCommonStruc();
createSceLibEntPpu32Struc();
createSceLibEntPpu64Struc();
//Process param
createSysProcessParamTDataStruc();
//Process Prx
createSysProcessPrxInfoTDataStruc();
}
/* Process PRX */
static StructureDataType sysProcessPrxInfoTDataType;
private static void createSysProcessPrxInfoTDataStruc() {
sysProcessPrxInfoTDataType = new StructureDataType(new CategoryPath("/PS3"), "sys_process_prx_info_t", 0);
sysProcessPrxInfoTDataType.add(UnsignedIntegerDataType.dataType, "size", "");
sysProcessPcreateStructureTypes method · java · L5-L27 (23 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/Ps3DataStructureTypes.java
public static void createStructureTypes() {
//Module info
createSceModuleInfoCommonDataStruc();
createSceModuleInfoPpu32Struc();
createSceModuleInfoPpu64Struc();
//Imports
createSceLibStubCommonStruc();
createSceLibStubPpu32Struc();
createSceLibStubPpu64Struc();
//Exports
createSceLibEntCommonStruc();
createSceLibEntPpu32Struc();
createSceLibEntPpu64Struc();
//Process param
createSysProcessParamTDataStruc();
//Process Prx
createSysProcessPrxInfoTDataStruc();
}createSysProcessPrxInfoTDataStruc method · java · L32-L45 (14 LOC)research/heloerScripts/Ps3GhidraScripts/ghidra_scripts/Ps3DataStructureTypes.java
private static void createSysProcessPrxInfoTDataStruc() {
sysProcessPrxInfoTDataType = new StructureDataType(new CategoryPath("/PS3"), "sys_process_prx_info_t", 0);
sysProcessPrxInfoTDataType.add(UnsignedIntegerDataType.dataType, "size", "");
sysProcessPrxInfoTDataType.add(UnsignedIntegerDataType.dataType, "magic", "");
sysProcessPrxInfoTDataType.add(UnsignedIntegerDataType.dataType, "version", "");
sysProcessPrxInfoTDataType.add(UnsignedIntegerDataType.dataType, "sdk_version", "");
sysProcessPrxInfoTDataType.add(UnsignedIntegerDataType.dataType, "libent_start", "");
sysProcessPrxInfoTDataType.add(UnsignedIntegerDataType.dataType, "libent_end", "");
sysProcessPrxInfoTDataType.add(UnsignedIntegerDataType.dataType, "libstub_start", "");
sysProcessPrxInfoTDataType.add(UnsignedIntegerDataType.dataType, "libstub_end", "");
sysProcessPrxInfoTDataType.add(UnsignedCharDataType.dataType, "major_version", "");