Dismiss Notice

BEWARE of IMPOSTERS, posing as the PS3Xploit Members/Team:


  -PS3Xploit does NOT have a discord channel, some imposter are using one
 

  -If the info can't be found on ps3xploit.com or psx-place.com its fake
 

  -ZuKuTo / OFWModz is one of the fake names of these imposter's are using to represent the PS3xploit team.

 

 

WebKit ROP Chain Tutorials [Creation/Editing/Debugging] - PS3 Development

Discussion in 'PS3Xploit DeV / PoC' started by esc0rtd3w, Dec 18, 2017.

  1. 1,244
    3,017
    397
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    1,244
    Likes Received:
    3,017
    Trophy Points:
    397
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:
    good to hear things are working for you! :D

    symbolic link has not been tested, only params added for syscall. there may be other things needed before it works. there may be info in PSDevWiki or other places, i have not looked much yet.

    you can try other syscalls and test :-p

    rename should work to rename any valid path

    you can check in a debugger, is the only way to verify what is happening!

    also, the database may need rebuilt for any added stuff under normal dev_hdd0/game/ to show up on XMB anyways, im pretty sure
     
    Last edited: Jan 3, 2018
  2. 114
    81
    32
    k9mo

    k9mo Member

    Joined:
    Aug 7, 2017
    Messages:
    114
    Likes Received:
    81
    Trophy Points:
    32
    Gender:
    Male
    Actually because i dont have a debugger i check using true ancestor i make the syscall like make a directory then backup my ps3 and extract it all with idps and then i check dev_hdd0 folder. it works i checked new directory called test was there
     
    esc0rtd3w likes this.
  3. 1,244
    3,017
    397
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    1,244
    Likes Received:
    3,017
    Trophy Points:
    397
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:
    ahh...good test! you can edit address and try memdump to USB so you can see some values without debugger...not nearly the same...but something :-p
     
  4. 29
    19
    7
    The unknown knight

    The unknown knight Forum Noob

    Joined:
    Dec 29, 2017
    Messages:
    29
    Likes Received:
    19
    Trophy Points:
    7
    Gender:
    Male
    @esc0rtd3w i have a question bro in case statement db_rebuild does :
    sc1_r30=usb_fp_addr+0x1E translate to:var db_rebuild_bytes=0x000003E9; ??
     
    Last edited: Jan 4, 2018
  5. 1,244
    3,017
    397
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    1,244
    Likes Received:
    3,017
    Trophy Points:
    397
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:
    sc1_r30 is the value at register 30 for the 1st syscall. it is using the offset at usb_fp +0x1E, so if the usb_fp address found was, lets say.... 0x80243812 then the offset for usb_fp is 0x80243812 and usb_fp+0x1E is 0x80243830

    the db_rebuild_bytes are also at an offset of usb_fp and is just an address. if you view that address in debugger, you will find the bytes 00 00 03 E9

    btw, the newest base has been updated a few days ago and replaces usb_fp with base_fp and sets several pointers already
     
    The unknown knight likes this.
  6. 114
    81
    32
    k9mo

    k9mo Member

    Joined:
    Aug 7, 2017
    Messages:
    114
    Likes Received:
    81
    Trophy Points:
    32
    Gender:
    Male
    Nice idea but wouldn't i need a debugger to know the address of the part i want to dump?
    Also another question if i wanted to edit bytes being written to change it to a file from usb do i have to get an address of that file in the usb from my ps3 memory using debugger? Or do i just add the whole hex values of the file?
    In the case of adding the hex values can i write :
    Sc1_r30=(the hex values of the file) instead of:
    Sc1_r30=(the address that holds the bytes)
    And i also add test_one_bytes=(the hex values of the file) in default.js ?? And ofcorse add path in path.js and append in loader and make a case statment.
     
    Last edited: Jan 5, 2018
  7. 46
    31
    17
    Amaan Khan

    Amaan Khan Member

    Joined:
    Nov 12, 2017
    Messages:
    46
    Likes Received:
    31
    Trophy Points:
    17
    Gender:
    Male
    Location:
    New Delhi,INDIA
    Bro r u trying to make a file writer?
     
  8. 46
    31
    17
    Amaan Khan

    Amaan Khan Member

    Joined:
    Nov 12, 2017
    Messages:
    46
    Likes Received:
    31
    Trophy Points:
    17
    Gender:
    Male
    Location:
    New Delhi,INDIA
    Or HDD writer
     
  9. 114
    81
    32
    k9mo

    k9mo Member

    Joined:
    Aug 7, 2017
    Messages:
    114
    Likes Received:
    81
    Trophy Points:
    32
    Gender:
    Male
    Well a writer that writes a file to HDD
    @esc0rtd3w i thought about something in defaults.js there is db_rebuild_bytes=0x000003E9
    (which are added in base_fp(hex2bin(write_bytes))
    Those are the bytes being written but if i want to write a whole folder what do i write instead of bytes because you know you cant get bytes from folder you get it only from file or do we just point to the address of the folder without specifying the bytes being written but if so what do we add at base_fp .
     
    Last edited: Jan 5, 2018
  10. 1,244
    3,017
    397
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    1,244
    Likes Received:
    3,017
    Trophy Points:
    397
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:
    if you guys actually watch the videos...you will have your answers...

    if it is beyond your grasp or you do not have the time to learn, then you have to wait...there is no time frame on anything....this is for fun! :-p

    as far as the HDD Writer stuff....it already is ....so......hmmmmmm
     
    Last edited: Jan 5, 2018
    pink1 likes this.
  11. 7,860
    6,592
    647
    bguerville

    bguerville Moderator

    Joined:
    Feb 25, 2015
    Messages:
    7,860
    Likes Received:
    6,592
    Trophy Points:
    647
    Location:
    Earth
    You cannot use a file write function to write a full folder! Additionally don't confuse loading a file in memory to edit its contents then saving it (ie patching) with simply copying/replacing a file, as that may or may not require loading it into memory at all, it all depends on how you do things, and loading a file in memory to copy it means making 2 file open operations & 2 file close, not just one...

    Check the s#ny sdk & psdevwiki for the file operations syscalls or use standard C library exports to see what is available to you for the file operations you need.

    Then for each operation you usually need to use a couple of gadgets to setup the function/syscall parameters then a third gadget to call the syscall or the vsh export.
    Each operation will be 3 gadgets long.
    So obviously if you need to create a folder then that's 3 gadgets for starters, each copy operation is up to 18 gadgets depending on how you handle it (the standard long way loading each file into memory then saving it elsewhere would be 6 operations: open/read/close then open/write/close), 3 gadgets for deletes etc..
    That's also why ROP is not really suited to this kind of things although it's quite easy to do as all necessary gadgets are already available in this tutorial ... Keep in mind that generally speaking, the most difficult part of ROPing (and especially so on ppc) is to find the gadgets you require to achieve your objectives, the stack frame implementation is actually the easier part...

    Usually we search for individual gadget & we assemble them in a linear way as a chain, without actual testing, to do that, you must understand the basics of ppc language, there is no way around it... Although all the hardest work has been done for you here & you can reuse the gadgets as well as their corresponding stack frame portions, understanding the most common ppc instructions is still a requirement to complete the job you have in mind. That and using a debugger in DEX to test/debug/validate....
    FYI, IF programming comes quite naturally to you, learning ppc basics may still seem impossible but it's not, if you spent say a couple of weeks reading about + debugging ppc 2 hours every day, you would likely learn enough to get started. So it's all a matter of time & perspective...

    Note that it's possible to actually "copy" or rather "move" a file or a complete folder by using the trick of renaming that file/folder...

    http://www.psdevwiki.com/ps3/LV2_Functions_and_Syscalls
    http://www.psdevwiki.com/ps3/VSH_Exports
     
    Last edited: Jan 6, 2018
    k9mo, pink1 and esc0rtd3w like this.
  12. 114
    81
    32
    k9mo

    k9mo Member

    Joined:
    Aug 7, 2017
    Messages:
    114
    Likes Received:
    81
    Trophy Points:
    32
    Gender:
    Male
    @bguerville Yeah thought of it but i think its limited to moving files/folders inside of hdd only .
     
    Last edited: Jan 7, 2018
    esc0rtd3w likes this.
  13. 114
    81
    32
    k9mo

    k9mo Member

    Joined:
    Aug 7, 2017
    Messages:
    114
    Likes Received:
    81
    Trophy Points:
    32
    Gender:
    Male
    @bguerville sorry bro for my last reply i placed it at the wrong thread .
    I read the link you provided me but there was just one thing left unclear the function rename does it rename file extensions as well like song.mp3 to picture.png??
    Thanks again for your last reply sorry for replying at the wrong thread earlier.
     
  14. 7,860
    6,592
    647
    bguerville

    bguerville Moderator

    Joined:
    Feb 25, 2015
    Messages:
    7,860
    Likes Received:
    6,592
    Trophy Points:
    647
    Location:
    Earth
    newname/oldname are full path actually.
    A full path contains the extension too so you can change it.

    Oh and I just checked in the sdk, I was correct, cellFsRename must be used on the same mount point, just like libc rename, so a cellFsRename from usb to hdd is not possible... As expected..
     
    esc0rtd3w and k9mo like this.
  15. 114
    81
    32
    k9mo

    k9mo Member

    Joined:
    Aug 7, 2017
    Messages:
    114
    Likes Received:
    81
    Trophy Points:
    32
    Gender:
    Male
    Thanks bro for the information .
    I was wondering but before asking IDK if this is the right thread so sorry in advance if its in the wrong thread . My question is we can copy photos and songs from usb to hdd right? Which syscalls are being used to do this process and can they be edited to copy files/folders other than photos,songs and game saves??
     
  16. 7,860
    6,592
    647
    bguerville

    bguerville Moderator

    Joined:
    Feb 25, 2015
    Messages:
    7,860
    Likes Received:
    6,592
    Trophy Points:
    647
    Location:
    Earth
    Copying photo & music is done by a vsh function or by one of the functions in vsh modules.
    That function will be relying on a number of syscalls & exports, the same sys_fs syscalls & libc exports that we are currently using & possibly on loops to deal with multiple folders/files.
     
    esc0rtd3w and k9mo like this.
  17. 6,975
    6,554
    622
    sandungas

    sandungas Moderator Developer

    Joined:
    Dec 31, 2014
    Messages:
    6,975
    Likes Received:
    6,554
    Trophy Points:
    622
    Location:
    Babylon 20xxE series
    You have another way to copy custom files to internal hdd, with the "import savegame from usb" function
    Inside a savegame folder you can add custom files and when importing are copyed together with the other legit savegame files
    Not sure if there is some size limit though, but if there is some probably allows for a good amount of MB

    Just mentioning it incase you want to take a look at that
     
    k9mo and esc0rtd3w like this.
  18. 114
    81
    32
    k9mo

    k9mo Member

    Joined:
    Aug 7, 2017
    Messages:
    114
    Likes Received:
    81
    Trophy Points:
    32
    Gender:
    Male
    @sandungas thx bro ill be testing that
    @esc0rtd3w i tested the rename function it doesn't work i tried renaming test to testnew as default first i made a dir named test successfully then tried renaming it rebooted successfully but checking the backup its still named test but one change happened now when you open the test dir there is an empty folder named test.tx so i tried again this time i rebuilt db after renaming same thing happened only empty test.tx folder is created in test directory hope you check it bro.
     
    esc0rtd3w likes this.
  19. 114
    81
    32
    k9mo

    k9mo Member

    Joined:
    Aug 7, 2017
    Messages:
    114
    Likes Received:
    81
    Trophy Points:
    32
    Gender:
    Male
    @esc0rtd3w i tested all of the functions on the new test file all of them work perfectly and even success rate is much much higher but the rename function has some bugs which include:
    1- if the file path is long it wont rename it example if the file path is /dev_hdd0/photo/2017/02/01/test-file.txt then it wont rename it. It only renames it if path is short.
    2-it doesn't move directories(folders) i mean it move files from one place to another but not directories i don't know why.
     
    esc0rtd3w likes this.
  20. 72
    135
    57
    jamesbond

    jamesbond Member

    Joined:
    Dec 5, 2015
    Messages:
    72
    Likes Received:
    135
    Trophy Points:
    57
    Gender:
    Male
    Occupation:
    Web Designer / Game Designer
    Location:
    Florianópolis, Brazil
    Sorry for bumping here, however, any news on SuperSlim Hack/HEN/CFW?
     

Share This Page