52w ago - Shortly following the
Alpha 2 Module release, today
KDSBest has updated their PS3 / PC SPU emulation project which allows your x86 machine to emulate the PlayStation 3 SPU to Beta status.
Download:
PS3 SPU Emulation Beta Module
To quote: Let's call it beta (SPU emulation). Tested with my own elf a lot commands if they work properly. Disabled buttons depending on state.
And last but not least, if you press run a new thread is spawned. Now you are able to press pause and it stops the run ofc. The performance get a super boost with the threading.
Project Update: alpha2 - pre alpha so it is not in pre alpha stage anymore. It detects code modifications on the fly too. The new feature list is not complete that's my fault I guess.
Thanks for the news update. I need some infos from some reversers to create the next stunning feature:
Crypto dumping... dumps all crypto calls... Let's call it function parameter dumping cause it will work for everything and will implement a callback on known functions which will make dumping at certain calls possible.
I try to implement this and GET/PUT DMA commands this weekend. I think I can't finish it this weekend, but this will be the beta stage. V0.9 should then just implement the rest of the commands that anergistic implements.
After that it is unknown what I do and so on. Since then my reversing starts to get more focus.
Update: From
mr_wicked: I was trying to run an SPU module in anergistic with no success. In IBM systemsim (in combination with libspe2) my code ran just fine..
Finding a broken instruction in anergistic is like finding a needle in a haystack. So I ended up throwing IBM systemsim in IDA and exported all SPU instructions to .asm. After writing a small emulator around these instructions I was able to find two nasty errors. One in "andhi" and one in the "cgx" instruction. Here are the corrected Anergistic instructions:
00010101,ri10,andhi,half,signed
{
int i;
for (i = 0; i < 8; ++i)
rth[i] = rah[i] & i10;
}
01101000010,rr,cgx
{
int i;
for (i = 0; i < 4; ++i)
{
u64 r = (u64)(rtw[i] & 1) + (u64) raw[i] + (u64) rbw[i];
rtw[i] = (r >> 32) & 1;
}
} My application also needed rotqbybi and rotqbi so I implemented those as well:
00111001100,rr,rotqbybi
{
u32 shift_count = (rbw[0] & 0x7f) >> 3;
rtw[0] = raw[0];
rtw[1] = raw[1];
rtw[2] = raw[2];
rtw[3] = raw[3];
while (shift_count--)
{
rtw[0] = (rtw[0] << 8) | (rtw[1] >> 24);
rtw[1] = (rtw[1] << 8) | (rtw[2] >> 24);
rtw[2] = (rtw[2] << 8) | (rtw[3] >> 24);
rtw[3] = (rtw[3] << 8) | (rtw[0] >> 24);
}
}
00111011000,rr,rotqbi
{
u32 shift_count = (rbw[0] & 0x7f) & 7;
rtw[0] = raw[0];
rtw[1] = raw[1];
rtw[2] = raw[2];
rtw[3] = raw[3];
while (shift_count--)
{
u32 t = (rtw[1] >> 31) | 2 * rtw[0];
rtw[1] = (rtw[2] >> 31) | 2 * rtw[1];
rtw[2] = (rtw[3] >> 31) | 2 * rtw[2];
rtw[3] = (rtw[0] >> 31) | 2 * rtw[3];
rtw[0] = t;
}
} Although trivial to fix it was really nasty to find these. I couldn't find a repository with active development, so I'm posting it here.
Hello everyone! Just getting my toes wet with this jailbreaking thing.
Join date 2006 lol...
Download: http://multiupload.biz/44jzbeg5vo3v/SPU%20simulation_MultiUpload.biz.rar.html
Hi Community,
I wanted to contribute to the scene , so I coded a tool that might help the community our members and fellow dev's. This Tool is intended for dev's so please be careful if you don't know what you do. I will not be held responsible for any harm.
My tool is a emulator for PS3 modules (e.g metldr), it is in pre alpha stage but I thought, it would be great to get some community feedback.
How to use:
Not all SPU Commands are implemented yet, but it is easily extendable and I will make it support DMA, all SPU Commands and SPU Mailbox soon.
First open a .kds file. Check out the metldr.kds to see an example. The rest is like a normal debugger. If you put dumps of your reversed functions in the KnownFunctions folder, it will detect it and mark that function for you.
Just for example Mark the whole cellSpuAesDecryptCbcCfb128 function in HexView in IDA -> Right Click -> Save to File. Name the File "cellSpuAesDecryptCbcCfb128" without extension and copy it to the KnownFunctions Directory of the Emulator. Now all similar functions get automatic detected!
"Step" Executes next command, "Run" runs till breakpoint (Breakpoints are not implemented yet). Debug SPU Code in Windows.
Any questions? Just get back to me at twitter
Stay tuned
KDSBest
twitter.com/#!/KDSBest
PS: Thx for MK and cfwprophet (Team Acid) and of course to fail0verflow for anergistic, which helps a lot with it and even uses some functions of them.
More PlayStation 3 News...