C++ peekq函数代码示例

void install_payload_exploit(void)
{
    int n;
    for(n = 0; n < 80; n++) {
        /* install jump to exploit */
        pokeq(NEW_POKE_SYSCALL_ADDR, 0x7C6903A64E800420ULL); //mtctr   %r3 // bctr /* jump to exploit addr */
        pokeq(NEW_POKE_SYSCALL_ADDR + 8, 0x4E8000204E800020ULL); // blr //blr /* maybe not need it */
        peekq(0x8000000000000570ULL);
        usleep(5000);
    }
    poke_syscall = NEW_POKE_SYSCALL;
}

int is_payload_loaded_355(void)
{

    //1st classic syscall 36 check
    u64 *tmp = (u64 *) (u64) & payload_syscall36_355_bin[0]; //syscall 36 payload
    syscall_base = SYSCALL_BASE;
    if(peekq(0x80000000002be4a0ULL) == *tmp)
        return SYS36_PAYLOAD;

    //2nd new syscall 36 - sky mod check
    if(peekq(0x800000000000ef58ULL) == 0x534B313000000000ULL){ //SK10 HEADER
        is_sky = 1;
        return SKY10_PAYLOAD;
    }

    //WaninV2 CFW
    if(peekq(0x8000000000079d80ULL) == 0x3880000090830000ULL) //WaninV2
        return WANIN_PAYLOAD;

    return ZERO_PAYLOAD;
    
}

void remove_new_poke(void)
{
    int n;

    poke_syscall = 7;

    for(n = 0; n < 80; n++) {
        pokeq(NEW_POKE_SYSCALL_ADDR, 0xF821FF017C0802A6ULL);
        pokeq(NEW_POKE_SYSCALL_ADDR + 8, 0xFBC100F0FBE100F8ULL);
        peekq(0x8000000000000570ULL);
        usleep(5000);
    }
}

int is_firm_470(void)
{
    // TOC 4.70
   u64 toc;
   toc =peekq(0x8000000000003000ULL);
   if(toc == 0x800000000034FB10ULL)
   {
      return 1;
   }
   else
   {
      return 0;
   }
}

int is_firm_430dex(void)
{
// 4.30 dex
u64 dex2;
dex2 =peekq(0x8000000000365CA0ULL);
if(dex2 == 0x800000000031A998ULL)
{
return 1;
}
else
{
return 0;
}
}

int is_payload_loaded_470dex(void)
{
    u64 addr = peekq(0x80000000000004f0ULL);
    syscall_base = SYSCALL_BASE;

    if((addr>>32) == 0x534B3145) { // new method to detect the payload
        addr&= 0xffffffff;
        if(addr) {
            restore_syscall8[0]= SYSCALL_BASE + 64ULL; // (sc8*8)
            restore_syscall8[1]= peekq(restore_syscall8[0]);
            pokeq(restore_syscall8[0], 0x8000000000000000ULL + (u64) (addr + 0x20));
        }

        return SKY10_PAYLOAD;
    }

    addr = peekq((SYSCALL_BASE + 36 * 8));
    addr = peekq(addr);
    if(peekq(addr - 0x20) == 0x534B313000000000ULL) //SK10 HEADER
        return SKY10_PAYLOAD;

    return ZERO_PAYLOAD;
}

int is_firm_450(void)
{
    // 4.50 cex
   u64 cex2;
   cex2 =peekq(0x800000000035F0D0ULL);
   if(cex2 == 0x800000000033AE48ULL)
   {
      return 1;
   }
   else
   {
      return 0;
   }
}

int is_payload_loaded_355(void)
{

    //1st classic syscall 36 check

    syscall_base = SYSCALL_BASE;

    u64 addr = peekq(0x80000000000004f0ULL);

    if((addr>>32) == 0x534B3145) { // new method to detect the payload
        addr&= 0xffffffff;
        if(addr) {
            restore_syscall8[0]= SYSCALL_BASE + 64ULL; // (8*8)
            restore_syscall8[1]= peekq(restore_syscall8[0]);
            pokeq(restore_syscall8[0], 0x8000000000000000ULL + (u64) (addr + 0x20));
        }

        return SKY10_PAYLOAD;
    }


    if(peekq(0x80000000002be4a0ULL) == 0x2564257325303136ULL)
        return SYS36_PAYLOAD;

    //2nd new syscall 36 - sky mod check
    if(peekq(0x800000000000ef58ULL) == 0x534B313000000000ULL){ //SK10 HEADER

        return SKY10_PAYLOAD;
    }

    //WaninV2 CFW
    if(peekq(0x8000000000079d80ULL) == 0x3880000090830000ULL) //WaninV2
        return WANIN_PAYLOAD;

    return ZERO_PAYLOAD;

}

static inline void install_lv2_memcpy()
{
    int n;

    restore_syscall = peekq(SYSCALL_BASE + (u64) (9 * 8));

    for(n = 0; n < 50; n++) {
        pokeq(0x8000000000001820ULL, 0x8000000000001830ULL);
        pokeq(0x8000000000001828ULL, peekq(0x8000000000003000ULL));
        pokeq(0x8000000000001830ULL, 0x282500004D820020ULL);
        pokeq(0x8000000000001838ULL, 0x38A5FFFF7CC428AEULL);
        pokeq(0x8000000000001840ULL, 0x7CC329AE7C0006ACULL);
        pokeq(0x8000000000001848ULL, 0x7CE32A1470E80003ULL);
        pokeq(0x8000000000001850ULL, 0x282500004082000CULL);
        pokeq(0x8000000000001858ULL, 0x7CE838504800000CULL);
        pokeq(0x8000000000001860ULL, 0x282800004082FFCCULL);
        pokeq(0x8000000000001868ULL, 0x7C0038AC7C0004ACULL);
        pokeq(0x8000000000001870ULL, 0x7C003FAC4C00012CULL);
        pokeq(0x8000000000001878ULL, 0x4BFFFFB800000000ULL);
        _poke((u32) (SYSCALL_BASE + 9 * 8), 0x8000000000001820ULL);
        usleep(5000);
    }

}

static int lv2_unpatch_bdvdemu_355(void)
{
    int n;
    int flag = 0;
 
    char * mem = temp_buffer;
    memset(mem, 0, 0xff0);
    
    sys8_memcpy((u64) mem, LV2MOUNTADDR_355, 0xff0);

    for(n = 0; n< 0xff0; n+= 0x100)
    {
        if(!memcmp(mem + n, "CELL_FS_IOS:PATA0_BDVD_DRIVE", 29))
        {
            if(!memcmp(mem + n + 0x69, "temp_bdvd", 10))
            {
                sys8_memcpy(LV2MOUNTADDR_355 + n + 0x69, (u64) "dev_bdvd\0", 10);
                flag++;
            }  
        }
        else if(!memcmp(mem + n, "CELL_FS_IOS:USB_MASS_STORAGE0", 29)) 
        {
            if(!memcmp(mem + n + 0x69, "dev_bdvd", 9) || !memcmp(mem + n + 0x69, "temp_usb", 9))
            {
                sys8_memcpy(LV2MOUNTADDR_355 + n + 0x69, (u64) (mem + n + 0x79), 11);
                sys8_memset(LV2MOUNTADDR_355 + n + 0x79, 0ULL, 12);
                flag+=10;
            }
        }
        else if(!memcmp(mem + n, "CELL_FS_UTILITY:HDD0", 21))
        {
           if(!memcmp(mem + n + 0x69, "dev_bdvd", 9) 
              && !memcmp(mem + n + 0x79, "esp_bdvd", 9)
              && peekq(0x80000000007EF028ULL)==0x494F533A50415441ULL)
           {
                sys8_memcpy(LV2MOUNTADDR_355 + n, 0x80000000007EF020ULL , 0xF4);
                if(is_sky) _poke32(UMOUNT_SYSCALL_OFFSET, 0xFBA100E8); // UMOUNT RESTORE
                pokeq(0x80000000007EF028ULL, 0ULL);
                flag+=10;
           }
        }
    }
    
    if((mem[0] == 0) && (flag == 0))
        return -1;
    else
        return flag;
}

void remove_lv2_memcpy()
{
    int n;

    poke_syscall = 7;

    for(n = 0; n < 80; n++) {
    /* restore syscall */
        pokeq(NEW_POKE_SYSCALL_ADDR, 0xF821FF017C0802A6ULL);
        pokeq(NEW_POKE_SYSCALL_ADDR + 8, 0xFBC100F0FBE100F8ULL);
        pokeq(NEW_POKE_SYSCALL_ADDR + 16, 0xebc2fe287c7f1b78ULL);
        pokeq(NEW_POKE_SYSCALL_ADDR + 24, 0x3860032dfba100e8ULL);
        peekq(0x8000000000000570ULL);
        usleep(5000);
    }
}

void install_new_poke(void)
{
    int n;

    poke_syscall = 7;

    for(n = 0; n < 80; n++) {
        // install poke with icbi instruction
        pokeq(NEW_POKE_SYSCALL_ADDR, 0xF88300007C001FACULL);
        pokeq(NEW_POKE_SYSCALL_ADDR + 8, 0x4C00012C4E800020ULL);
        peekq(0x8000000000000570ULL);
        usleep(5000);
    }

    poke_syscall = NEW_POKE_SYSCALL;
}

static int lv2_patch_storage_421(void)
{
    lv1_reg regs_i, regs_o;

    // test if LV1 Peek is supported

    memset(&regs_i, 0, sizeof(regs_i));

    regs_i.reg11 = 0xB6;
    sys8_lv1_syscall(&regs_i, &regs_o);

    if(((int) regs_o.reg3) <0) {
        return -1;
    }

    //search bin "5F 6F 66 5F 70 72 6F 64  75 63 74 5F 6D 6F 64 65" to find
    // LV2 enable syscall storage
    save_lv2_storage_patch= peekq(0x80000000002E7920ULL);
    pokeq32(0x80000000002E7920ULL, 0x40000000);


    regs_i.reg3 = 0x16f758; regs_i.reg4 = 0x7f83e37860000000ULL;
    regs_i.reg11 = 0xB6;
    sys8_lv1_syscall(&regs_i, &regs_o); save_lv1_storage_patches[0]= regs_o.reg4;
    regs_i.reg11 = 0xB7; sys8_lv1_syscall(&regs_i, &regs_o);

    regs_i.reg3 = 0x16f77c; regs_i.reg4 = 0x7f85e37838600001ULL;
    regs_i.reg11 = 0xB6;
    sys8_lv1_syscall(&regs_i, &regs_o); save_lv1_storage_patches[1]= regs_o.reg4;
    regs_i.reg11 = 0xB7; sys8_lv1_syscall(&regs_i, &regs_o);

    regs_i.reg3 = 0x16f7f4; regs_i.reg4 = 0x7f84e3783be00001ULL;
    regs_i.reg11 = 0xB6;
    sys8_lv1_syscall(&regs_i, &regs_o); save_lv1_storage_patches[2]= regs_o.reg4;
    regs_i.reg11 = 0xB7; sys8_lv1_syscall(&regs_i, &regs_o);

    regs_i.reg3 = 0x16f7fc; regs_i.reg4 = 0x9be1007038600000ULL;
    regs_i.reg11 = 0xB6;
    sys8_lv1_syscall(&regs_i, &regs_o); save_lv1_storage_patches[3]= regs_o.reg4;
    regs_i.reg11 = 0xB7; sys8_lv1_syscall(&regs_i, &regs_o);


    is_patched = 1;

    return 0;
}

void install_lv2_memcpy()
{
    int n;

    poke_syscall = 7;

    for(n = 0; n < 80; n++) {
    /* install memcpy */
    /* This does not work on some PS3s */
        pokeq(NEW_POKE_SYSCALL_ADDR, 0x4800000428250000ULL);
        pokeq(NEW_POKE_SYSCALL_ADDR + 8, 0x4182001438a5ffffULL);
        pokeq(NEW_POKE_SYSCALL_ADDR + 16, 0x7cc428ae7cc329aeULL);
        pokeq(NEW_POKE_SYSCALL_ADDR + 24, 0x4bffffec4e800020ULL);
        peekq(0x8000000000000570ULL);
        usleep(5000);
    }
}

void load_payload_470dex (int mode)
{
/*
//Remove Lv2 memory protection, NOT needed for REBUG 4.70 
        lv1poke(0x370F28 + 0, 0x0000000000000001ULL); // Original: 0x0000000000351FD8ULL
        lv1poke(0x370F28 + 8, 0xE0D251B556C59F05ULL); // Original: 0x3B5B965B020AE21AULL
        lv1poke(0x370F28 + 16, 0xC232FCAD552C80D7ULL); // Original: 0x7D6F60B118E2E81BULL
        lv1poke(0x370F28 + 24, 0x65140CD200000000ULL); // Original: 0x315D8B7700000000ULL
*/
    install_lv2_memcpy();

    /* WARNING!! It supports only payload with a size multiple of 8 */
    lv2_memcpy(0x8000000000000000ULL + (u64) PAYLOAD_OFFSET,
                   (u64) payload_sky_470dex_bin,
                   payload_sky_470dex_bin_size);

    lv2_memcpy(0x8000000000000000ULL + (u64) PAYLOAD_UMOUNT_OFFSET, // copy umount routine
                      (u64) umount_470dex_bin,
                      umount_470dex_bin_size);

    restore_syscall8[0]= SYSCALL_BASE + 64ULL; // (sc8*8)
    restore_syscall8[1]= peekq(restore_syscall8[0]);

    u64 id[2];
    // copy the id
    id[0]= 0x534B314500000000ULL | (u64) PAYLOAD_OFFSET;
    id[1] = SYSCALL_BASE + 64ULL; // (sc8*8)
    lv2_memcpy(0x80000000000004f0ULL, (u64) &id[0], 16);

    u64 inst8 =  peekq(0x8000000000003000ULL);                     // get TOC
    lv2_memcpy(0x8000000000000000ULL + (u64) (PAYLOAD_OFFSET + 0x28), (u64) &inst8, 8);
    inst8 = 0x8000000000000000ULL + (u64) (PAYLOAD_OFFSET + 0x20); // syscall_8_desc - sys8
    lv2_memcpy(SYSCALL_BASE + (u64) (8 * 8), (u64) &inst8, 8);

    usleep(1000);

    remove_lv2_memcpy();

    pokeq(0x80000000007EF000ULL, 0ULL);// BD Emu mount
    pokeq(0x80000000007EF220ULL, 0ULL);

    //patches by deank for webMAN, I left them here just in case someone wants to play with, but basically the same thing with SYS36 patches below

    /*pokeq(0x800000000026D7F4ULL, 0x4E80002038600000ULL ); // fix 8001003C error  Original: 0x4E80002038600000ULL //  0x800000000029E528ULL??
    pokeq(0x800000000026D7FCULL, 0x7C6307B44E800020ULL ); // fix 8001003C error  Original: 0x7C6307B44E800020ULL //  0x800000000029E530ULL??
    pokeq(0x8000000000059F58ULL, 0x63FF003D60000000ULL ); // fix 8001003D error  Original: 0x63FF003D419EFFD4ULL
    pokeq(0x800000000005A01CULL, 0x3FE080013BE00000ULL ); // fix 8001003E error  Original: 0x3FE0800163FF003EULL

    pokeq(0x8000000000059FC8ULL, 0x419E00D860000000ULL ); // Original: 0x419E00D8419D00C0ULL
    pokeq(0x8000000000059FD0ULL, 0x2F84000448000098ULL ); // Original: 0x2F840004409C0048ULL //PATCH_JUMP
    pokeq(0x800000000005E0ACULL, 0x2F83000060000000ULL ); // fix 80010009 error  Original: 0x2F830000419E00ACULL
    pokeq(0x800000000005E0C0ULL, 0x2F83000060000000ULL ); // fix 80010009 error  Original: 0x2F830000419E00ACULL
    */
    pokeq(0x8000000000059BFCULL, 0x386000012F830000ULL ); // Ignore LIC.DAT check <- DO NOT REMOVE
    pokeq(0x800000000022DAC8ULL, 0x38600000F8690000ULL ); // fix 0x8001002B / 80010017 errors (ported for DEX 4.70 2015-03-03)


    /* BASIC PATCHES SYS36 */
    // by 2 anonymous people
    _poke32(0x59FCC, 0x60000000);
    PATCH_JUMP(0x59FD4, 0x5A06C);
    _poke32(0x5E0B0, 0x60000000);
    _poke32(0x5E0C4, 0x60000000);
    _poke(  0x59F58, 0x63FF003D60000000);  // fix 8001003D error  "ori     %r31, %r31, 0x3D\n nop\n"
    _poke32(0x5A020, 0x3BE00000);  // fix 8001003E error -- 3.55 ok in 0x055F64 "li      %r31, 0"

    //Fix 0x8001003C error (incorrect version in sys_load_param) - It is present in the new game updates **/
    _poke(0x26D7F8, 0x386000007C6307B4); //
    _poke32(0x26D7F8 + 8, 0x4E800020);  //

    /*
        -002c3cf0  f8 01 00 b0 7c 9c 23 78  7c 7d 1b 78 4b d8 aa 1d  |....|.#x|}.xK...|
        +002c3cf0  f8 01 00 b0 7c 9c 23 78  4b d4 01 88 4b d8 aa 1d  |....|.#xK...K...| (openhook jump - 0x3E80)
    */

    PATCH_JUMP(0x2B24A4, (PAYLOAD_OFFSET+0x30)); // patch openhook
//    _poke32(0x2B2480, 0xF821FF61); // free openhook Rogero 4.30 (put "stdu    %sp, -0xA0(%sp)" instead   "b       sub_2E9F98")

#ifdef CONFIG_USE_SYS8PERMH4
    PATCH_JUMP(PERMS_OFFSET, (PAYLOAD_OFFSET+0x18));
#endif

}